@jest/console — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aaronabramovsimenbrickhanloniiopenjs-operationscpojer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	no-description	AI (npm-metadata): Monorepo sub-package; missing description is a cosmetic issue, not a risk signal.	ai	2026/05/18
provenance	publisher-changed	AI (provenance): simenb is a known Jest core maintainer; cpojer→simenb is a legitimate project handoff.	ai	2026/05/18
publish-pattern	dormant-publish	AI (publish-pattern): Jest major version releases are infrequent; dormancy is normal for this monorepo package.	ai	2026/05/18
provenance	no-provenance	AI (provenance): Jest monorepo packages consistently publish without Sigstore provenance; stable pattern across all versions.	ai	2026/04/24
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): @types/node is a framework-scoped type package conventionally included as a runtime dep in Jest packages.	ai	2026/04/24
phantom-deps	phantom-dep:slash	AI (phantom-deps): slash is a legitimate runtime dep used in Jest build output; phantom detection is a false positive for this package.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): cpojer (Christoph Pojer) is a well-known Jest core contributor; addition reflects the jestjs org transition, not a suspicious takeover.	ai	2026/04/24
maintainer-change	maintainer-removed	AI (maintainer-change): Removals are consistent with the Jest project's transition to the jestjs GitHub org; no indication of malicious takeover.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): @jest/console is a legitimate Jest core package; no description/keywords are expected for internal monorepo packages. The spam-publisher signal is the real concern, not the package structure.	ai	2026/04/23

Versions (showing 80 of 80)

Version	Deps	Published
30.4.1	6 / 1	2026-05-08
30.4.0	6 / 1	2026-05-07
30.3.0	6 / 1	2026-03-10
30.2.0	6 / 1	2025-09-28
30.1.2	6 / 1	2025-09-01
30.1.1	6 / 1	2025-08-27
30.1.0	6 / 1	2025-08-27
30.0.5	6 / 1	2025-07-22
30.0.4	6 / 1	2025-07-02
30.0.2	6 / 1	2025-06-19
30.0.1	6 / 1	2025-06-18
29.7.0	6 / 1	2023-09-12
29.6.4	6 / 1	2023-08-24
29.6.3	6 / 1	2023-08-21
29.6.2	6 / 1	2023-07-27
29.6.1	6 / 1	2023-07-06
29.6.0	6 / 1	2023-07-04
29.5.0	6 / 1	2023-03-06
29.4.3	6 / 1	2023-02-15
29.4.2	6 / 1	2023-02-07
29.4.1	6 / 1	2023-01-26
29.4.0	6 / 1	2023-01-24
29.3.1	6 / 1	2022-11-08
29.2.1	6 / 1	2022-10-18
29.2.0	6 / 1	2022-10-14
29.1.2	6 / 1	2022-09-30
29.1.0	6 / 1	2022-09-28
29.0.3	6 / 1	2022-09-10
29.0.2	6 / 1	2022-09-03
29.0.1	6 / 1	2022-08-26
29.0.0	6 / 1	2022-08-25
28.1.3	6 / 1	2022-07-13
28.1.1	6 / 1	2022-06-07
28.1.0	6 / 1	2022-05-06
28.0.2	6 / 1	2022-04-27
28.0.1	6 / 1	2022-04-26
28.0.0	6 / 1	2022-04-25
27.5.1	6 / 2	2022-02-08
27.5.0	6 / 2	2022-02-05
27.4.6	6 / 2	2022-01-04
27.4.2	6 / 2	2021-11-30
27.4.1	6 / 2	2021-11-30
27.4.0	6 / 2	2021-11-29
27.3.1	6 / 2	2021-10-19
27.3.0	6 / 2	2021-10-17
27.2.5	6 / 2	2021-10-08
27.2.4	6 / 2	2021-09-29
27.2.3	6 / 2	2021-09-28
27.2.2	6 / 2	2021-09-25
27.2.0	6 / 2	2021-09-13
27.1.1	6 / 2	2021-09-08
27.1.0	6 / 2	2021-08-27
27.0.6	6 / 2	2021-06-28
27.0.2	6 / 2	2021-05-29
27.0.1	6 / 2	2021-05-25
27.0.0	6 / 2	2021-05-25
26.6.2	6 / 2	2020-11-02
26.6.1	6 / 1	2020-10-23
26.6.0	6 / 1	2020-10-19
26.5.2	6 / 1	2020-10-06
26.5.0	6 / 1	2020-10-05
26.3.0	6 / 1	2020-08-10
26.2.0	6 / 1	2020-07-30
26.1.0	5 / 1	2020-06-23
26.0.1	5 / 1	2020-05-05
26.0.0	5 / 1	2020-05-04
25.5.0	5 / 1	2020-04-28
25.4.0	5 / 1	2020-04-19
25.3.0	4 / 1	2020-04-08
25.2.6	4 / 1	2020-04-02
25.2.5	4 / 1	2020-04-02
25.2.3	4 / 1	2020-03-26
25.2.1	4 / 1	2020-03-26
25.2.0	4 / 1	2020-03-25
25.1.0	4 / 0	2020-01-22
25.0.0	3 / 0	2019-08-22
24.9.0	3 / 1	2019-08-16
24.7.1	3 / 1	2019-04-04
24.6.0	3 / 1	2019-04-01
24.3.0	4 / 1	2019-03-07

v30.4.1

2 findings

HIGH Publisher changed: cpojer → simenb (on 2026-05-08) provenance

This version was published by a different npm account than previous versions on 2026-05-08. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.4.0

2 findings

HIGH Publisher changed: cpojer → simenb (on 2026-05-07) provenance

This version was published by a different npm account than previous versions on 2026-05-07. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.7.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.