electron-mocha
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:silent-process-exec | AI (semgrep): Detached spawn runs cleanup.js via process.execPath on app quit — documented Electron cleanup pattern, not malicious. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same cleanup.js spawn; stable false positive for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used solely for the cleanup spawn; expected in an Electron test runner. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Standard Mocha --require plugin loader pattern; stable across versions. | ai | |
| phantom-deps | phantom-dep:which | AI (phantom-deps): which is a declared runtime dep used in bin scripts; phantom-dep heuristic misfires here. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 13.1.0 | 5 / 2 |
v13.1.0
3 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/jprichardson/electron-mocha/blob/8dcde8660baf826c46eb2be332b8d97d77cbce86/lib/main.js#L53 51 | // removing Electron's data out from under it 52 | app.on('quit', () => { > 53 | const child = spawn(process.execPath, ['cleanup.js', userData], { 54 | detached: true, 55 | stdio: 'ignore',
Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/jprichardson/electron-mocha/blob/8dcde8660baf826c46eb2be332b8d97d77cbce86/lib/main.js#L53 51 | // removing Electron's data out from under it 52 | app.on('quit', () => { > 53 | const child = spawn(process.execPath, ['cleanup.js', userData], { 54 | detached: true, 55 | stdio: 'ignore',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.