@testing-library/react-hooks
Simple and complete React hooks testing utilities that encourage good testing practices.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env-spread occurs only in test files simulating missing env vars for test isolation — not production code, no exfiltration risk. Stable false positive for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): dynamic-require is used in hasDependency() to probe for optional peer deps (react, react-dom, etc.). Standard pattern for packages with optional peers; not user-controlled input. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): @babel/runtime is injected by Babel build toolchain, not explicitly imported. Expected for transpiled TS packages. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 8.0.1 | 2 / 20 | |
| 8.0.0 | 2 / 20 | |
| 7.0.2 | 5 / 17 | |
| 7.0.1 | 5 / 15 | |
| 7.0.0 | 5 / 15 | |
| 6.0.0 | 6 / 15 | |
| 5.1.3 | 6 / 15 | |
| 5.1.2 | 6 / 15 | |
| 5.1.1 | 6 / 15 | |
| 5.1.0 | 6 / 15 | |
| 5.0.3 | 6 / 15 | |
| 5.0.2 | 6 / 15 | |
| 5.0.0 | 6 / 15 | |
| 4.0.1 | 3 / 13 | |
| 4.0.0 | 3 / 13 | |
| 3.7.0 | 2 / 10 | |
| 3.6.0 | 2 / 9 | |
| 3.5.0 | 2 / 9 | |
| 3.4.2 | 2 / 24 | |
| 3.4.1 | 2 / 24 | |
| 3.4.0 | 2 / 24 | |
| 3.3.0 | 2 / 24 | |
| 3.2.1 | 2 / 24 | |
| 3.2.0 | 2 / 24 | |
| 3.1.1 | 2 / 24 | |
| 3.1.0 | 2 / 24 | |
| 3.0.0 | 2 / 24 | |
| 2.0.3 | 2 / 24 | |
| 2.0.2 | 2 / 24 | |
| 2.0.1 | 3 / 26 | |
| 2.0.0 | 3 / 26 | |
| 1.1.0 | 3 / 26 | |
| 1.0.4 | 3 / 26 | |
| 1.0.3 | 3 / 26 | |
| 1.0.2 | 1 / 25 | |
| 1.0.1 | 1 / 25 | |
| 1.0.0 | 1 / 25 |
v8.0.1
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/testing-library/react-hooks-testing-library/blob/e2461ca4b5ab45813527f5e2478c4e8552f16c51/src/__tests__/autoCleanup.noProcessEnv.test.ts#L6 4 | // then we still auto-wire up the afterEach for folks 5 | describe('auto cleanup (no process.env) tests', () => { > 6 | process.env = { 7 | ...process.env, 8 | get RHTL_SKIP_AUTO_CLEANUP(): string | undefined {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/testing-library/react-hooks-testing-library/blob/e2461ca4b5ab45813527f5e2478c4e8552f16c51/src/__tests__/errorSuppression.noProcessEnv.test.ts#L5 3 | describe('error output suppression (no process.env) tests', () => { 4 | const originalConsoleError = console.error > 5 | process.env = { 6 | ...process.env, 7 | get RHTL_DISABLE_ERROR_FILTERING(): string | undefined {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.