← Home

@storybook/test

npm Repository Homepage
3
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ndelangenshilmantmeasdayghengeveldwinkervsbecksyannbfkylegachjreinholdkasperpeulenvalentinpalkovicdomyenstorybook-bot

Keywords

storybook

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@types/chai AI (dependencies): @types/chai is a well-known DefinitelyTyped package with millions of downloads; no real risk for this package. ai
phantom-deps phantom-dep:@types/chai AI (phantom-deps): Type-only dependency loaded by convention; not directly imported in runtime code. Expected pattern for TypeScript packages. ai
publish-pattern rapid-publish AI (publish-pattern): Storybook is a large monorepo that publishes many packages simultaneously via CI. Rapid successive publishes are expected and normal for this package. ai
provenance publisher-changed AI (provenance): shilman is a long-standing Storybook core maintainer; publisher rotations within the Storybook team are expected and not indicative of compromise. ai
publish-pattern new-deps-added AI (publish-pattern): @storybook/global is a first-party Storybook org package; adding intra-org deps is routine for this monorepo. ai
phantom-deps phantom-dep:@storybook/csf AI (phantom-deps): Same-org scope phantom dep in a monorepo sub-package; @storybook/csf is a legitimate Storybook dependency used indirectly. ai
phantom-deps phantom-dep:@storybook/preview-api AI (phantom-deps): Same-org dependency within the Storybook monorepo; phantom-dep detection is a known false positive for intra-monorepo packages. ai
typosquat typosquat.levenshtein:jest AI (typosquat): @storybook/test is the official Storybook testing utility, not a typosquat of jest. Scoped under the legitimate @storybook org with 764 versions and a trusted publisher. ai
typosquat typosquat.levenshtein:next AI (typosquat): @storybook/test is the official Storybook testing utility, not a typosquat of next. Levenshtein match is algorithmic noise for this well-established scoped package. ai
typosquat typosquat.levenshtein:vitest AI (typosquat): @storybook/test intentionally wraps @vitest/expect and @vitest/spy — similarity to vitest is by design, not impersonation. ai
phantom-deps phantom-dep:chai AI (phantom-deps): chai is a declared dependency explicitly listed in bundler.noExternal, meaning it is bundled into the dist output rather than directly imported at source level. ai
phantom-deps phantom-dep:@storybook/core-events AI (phantom-deps): Same-org dependency within the Storybook monorepo; phantom-dep detection is a known false positive for intra-monorepo packages. ai
dependencies unvetted-dep:@storybook/global AI (dependencies): @storybook/global is a first-party Storybook package from the same org/monorepo; not a third-party risk. Stable accept for this package. ai
npm-metadata no-description AI (npm-metadata): Empty description is a known pattern in some Storybook monorepo packages; all other metadata (repo, homepage, license, keywords) is present and correct. ai

Versions (showing 3 of 103)

Show 16 prereleases
Version Deps Published
7.6.2 12 / 3
7.6.1 12 / 3
7.6.0 12 / 3

v7.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.