@jest/expect-utils — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aaronabramovsimenbrickhanloniiopenjs-operationscpojer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): cpojer is a Jest co-creator and core maintainer; publisher change reflects legitimate OpenJS Foundation governance transition, not a compromise.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): rickhanlonii, openjs-operations, and cpojer are all legitimate Jest/OpenJS stakeholders added as part of the documented governance transition.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): Removed maintainers are consistent with the Jest project's OpenJS Foundation transition; not indicative of a takeover.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): @jest/get-type is a direct scoped rename of jest-get-type within the Jest monorepo; a benign v30 migration change.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): Internal monorepo utility package; sparse metadata is expected and not indicative of malice.	ai	2026/04/21
npm-metadata	no-description	AI (npm-metadata): Monorepo utility package; missing description is normal for internal packages within Jest.	ai	2026/04/21
dependencies	unvetted-dep:@jest/get-type	AI (dependencies): @jest/get-type is an official Jest scoped package from the same monorepo; unvetted only because it hasn't been reviewed yet, not because it's suspicious.	ai	2026/04/21

Versions (showing 40 of 40)

Version	Deps	Published
30.4.1	1 / 2	2026-05-08
30.4.0	1 / 2	2026-05-07
30.3.0	1 / 2	2026-03-10
30.2.0	1 / 2	2025-09-28
30.1.2	1 / 2	2025-09-01
30.1.1	1 / 2	2025-08-27
30.1.0	1 / 2	2025-08-27
30.0.5	1 / 2	2025-07-22
30.0.4	1 / 2	2025-07-02
30.0.3	1 / 2	2025-06-25
30.0.2	1 / 2	2025-06-19
30.0.1	1 / 2	2025-06-18
30.0.0	1 / 2	2025-06-10
29.7.0	1 / 4	2023-09-12
29.6.4	1 / 4	2023-08-24
29.6.3	1 / 4	2023-08-21
29.6.2	1 / 4	2023-07-27
29.6.1	1 / 4	2023-07-06
29.6.0	1 / 4	2023-07-04
29.5.0	1 / 4	2023-03-06
29.4.3	1 / 4	2023-02-15
29.4.2	1 / 4	2023-02-07
29.4.1	1 / 4	2023-01-26
29.4.0	1 / 4	2023-01-24
29.3.1	1 / 4	2022-11-08
29.2.2	1 / 4	2022-10-24
29.2.1	1 / 4	2022-10-18
29.2.0	1 / 4	2022-10-14
29.1.2	1 / 2	2022-09-30
29.1.0	1 / 2	2022-09-28
29.0.3	1 / 2	2022-09-10
29.0.2	1 / 2	2022-09-03
29.0.1	1 / 2	2022-08-26
29.0.0	1 / 2	2022-08-25
28.1.3	1 / 2	2022-07-13
28.1.1	1 / 2	2022-06-07
28.1.0	1 / 2	2022-05-06
28.0.2	1 / 1	2022-04-27
28.0.1	1 / 1	2022-04-26
28.0.0	1 / 1	2022-04-25

v30.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.4.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: cpojer → simenb (on 2026-05-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-07. This could indicate a legitimate maintainer transition or an account compromise.

v30.2.0

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-09-28) provenance

This version was published by a different npm account than previous versions on 2025-09-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.2

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-09-01) provenance

This version was published by a different npm account than previous versions on 2025-09-01. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.1

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-08-27) provenance

This version was published by a different npm account than previous versions on 2025-08-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.0

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-08-27) provenance

This version was published by a different npm account than previous versions on 2025-08-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.5

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-07-22) provenance

This version was published by a different npm account than previous versions on 2025-07-22. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.4

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-07-02) provenance

This version was published by a different npm account than previous versions on 2025-07-02. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.3

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-06-25) provenance

This version was published by a different npm account than previous versions on 2025-06-25. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.2

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-06-19) provenance

This version was published by a different npm account than previous versions on 2025-06-19. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.1

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-06-18) provenance

This version was published by a different npm account than previous versions on 2025-06-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.0

2 findings

HIGH Publisher changed: simenb → cpojer (on 2025-06-10) provenance

This version was published by a different npm account than previous versions on 2025-06-10. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v29.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v28.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.