chai
BDD/TDD assertion library for node.js and the browser. Test framework agnostic.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate transition to GitHub Actions CI/CD publishing, confirmed by SLSA provenance attestation from the canonical chaijs/chai repo. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() is used inside a Proxy getter trap for chai's chainable assertion syntax — a documented, legitimate pattern for this package across all versions. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): The added deps (assertion-error, check-error, deep-eql, loupe, pathval) are established chai ecosystem packages representing an intentional architectural split of chai's internals. | ai | |
| typosquat | typosquat.levenshtein:chalk | AI (typosquat): Chai is a massively popular, long-established assertion library predating this comparison. It is not a typosquat of chalk. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Chai is a massively popular, long-established assertion library. It is not a typosquat of hapi. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in chai is used to evaluate constrained operator strings in assertion logic, a documented internal pattern — not arbitrary external code execution. | ai |
Versions (showing 100 of 104)
| Version | Deps | Published |
|---|---|---|
| 6.2.2 | 0 / 18 | |
| 6.2.1 | 0 / 18 | |
| 6.2.0 | 0 / 18 | |
| 6.1.0 | 0 / 18 | |
| 6.0.1 | 0 / 17 | |
| 6.0.0 | 0 / 17 | |
| 5.3.3 | 5 / 12 | |
| 5.3.2 | 5 / 12 | |
| 5.3.1 | 5 / 11 | |
| 5.3.0 | 5 / 12 | |
| 5.2.2 | 5 / 12 | |
| 5.2.1 | 5 / 12 | |
| 5.2.0 | 5 / 11 | |
| 5.1.2 | 5 / 8 | |
| 5.1.1 | 5 / 8 | |
| 5.1.0 | 5 / 6 | |
| 5.0.3 | 5 / 6 | |
| 5.0.2 | 5 / 6 | |
| 5.0.0 | 5 / 7 | |
| 4.5.0 | 7 / 10 | |
| 4.4.1 | 7 / 10 | |
| 4.4.0 | 7 / 10 | |
| 4.3.10 | 7 / 10 | |
| 4.3.9 | 7 / 10 | |
| 4.3.8 | 7 / 10 | |
| 4.3.7 | 7 / 10 | |
| 4.3.6 | 7 / 10 | |
| 4.3.5 | 7 / 10 | |
| 4.3.4 | 6 / 10 | |
| 4.3.3 | 6 / 10 | |
| 4.3.2 | 6 / 10 | |
| 4.3.1 | 6 / 10 | |
| 4.3.0 | 6 / 10 | |
| 4.2.0 | 6 / 10 | |
| 4.1.2 | 6 / 9 | |
| 4.1.1 | 6 / 9 | |
| 4.1.0 | 6 / 9 | |
| 4.0.2 | 6 / 9 | |
| 4.0.1 | 6 / 9 | |
| 4.0.0 | 6 / 9 | |
| 3.5.0 | 3 / 9 | |
| 3.4.1 | 3 / 9 | |
| 3.4.0 | 3 / 9 | |
| 3.3.0 | 3 / 9 | |
| 3.2.0 | 3 / 9 | |
| 3.1.0 | 3 / 9 | |
| 3.0.0 | 3 / 9 | |
| 2.3.0 | 2 / 8 | |
| 2.2.0 | 2 / 7 | |
| 2.1.2 | 2 / 7 | |
| 2.1.1 | 2 / 7 | |
| 2.1.0 | 2 / 7 | |
| 2.0.0 | 2 / 7 | |
| 1.10.0 | 2 / 7 | |
| 1.9.2 | 2 / 7 | |
| 1.9.1 | 2 / 7 | |
| 1.9.0 | 2 / 7 | |
| 1.8.1 | 2 / 8 | |
| 1.8.0 | 2 / 8 | |
| 1.7.2 | 1 / 8 | |
| 1.7.1 | 1 / 5 | |
| 1.7.0 | 1 / 5 | |
| 1.6.1 | 0 / 5 | |
| 1.6.0 | 0 / 5 | |
| 1.5.0 | 0 / 6 | |
| 1.4.2 | 0 / 2 | |
| 1.4.1 | 0 / 2 | |
| 1.4.0 | 0 / 2 | |
| 1.3.0 | 0 / 2 | |
| 1.2.0 | 0 / 2 | |
| 1.1.1 | 0 / 2 | |
| 1.1.0 | 0 / 1 | |
| 1.0.4 | 0 / 1 | |
| 1.0.3 | 0 / 1 | |
| 1.0.2 | 0 / 1 | |
| 1.0.1 | 0 / 1 | |
| 1.0.0 | 0 / 1 | |
| 0.5.3 | 0 / 2 | |
| 0.5.2 | 0 / 2 | |
| 0.5.1 | 0 / 2 | |
| 0.5.0 | 0 / 2 | |
| 0.4.2 | 0 / 2 | |
| 0.4.1 | 0 / 2 | |
| 0.4.0 | 0 / 2 | |
| 0.3.4 | 0 / 2 | |
| 0.3.3 | 0 / 2 | |
| 0.3.2 | 0 / 2 | |
| 0.3.1 | 0 / 2 | |
| 0.3.0 | 0 / 2 | |
| 0.2.4 | 0 / 2 | |
| 0.2.3 | 0 / 2 | |
| 0.2.2 | 0 / 2 | |
| 0.2.1 | 0 / 2 | |
| 0.2.0 | 0 / 2 | |
| 0.1.7 | 0 / 2 | |
| 0.1.6 | 0 / 2 | |
| 0.1.5 | 0 / 2 | |
| 0.1.4 | 0 / 2 | |
| 0.1.3 | 0 / 2 | |
| 0.1.2 | 0 / 2 |
v6.2.1
2 findingsThis version was published by a different npm account than previous versions on 2025-11-11. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-02-12. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-12-28. This could indicate a legitimate maintainer transition or an account compromise.
v4.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.