codeclimate-test-reporter
Code Climate test reporter client for javascript projects
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): The added dependency (async) is a canonical, heavily-vetted npm package. This finding is a stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package is 4400 days old; provenance attestation was not available at publish time. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:request | AI (dependencies): request is used to POST coverage data to the Code Climate API — core functionality of this package, not a suspicious dependency. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change (noahd1 → gordondiggs) occurred in 2015 within the CodeClimate org. gordondiggs has 17 approved packages and no rejections; legitimate transition confirmed by ~9 years of clean history. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Same 2015 CodeClimate org transition. gordondiggs is a trusted publisher with a long clean track record; not a takeover. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in git_info.js solely to run 'git log' for coverage metadata. This is expected behavior for a test reporter tool and stable across versions. | ai | |
| semgrep | semgrep:child-process-exec | AI (semgrep): exec() calls in git_info.js run 'git log' commands to gather commit metadata for coverage reporting. Legitimate and expected for this package's purpose. | ai |
v0.5.1
2 findingsThis version was published by a different npm account than previous versions on 2018-10-08. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.