enzyme — Greenflagged

JavaScript Testing utilities for React

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

airbnbengetienne_tripiergdbortonintelligibabblelencioniljharbmilesjschleyfox

Keywords

javascriptshallow renderingshallowRendertestreactjsreactfluxtestingtest utilsassertion helperstddmocha

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): New dependencies are all established packages (lodash, uuid, object polyfills) appropriate for a React testing utility.	ai	2026/04/22
dependencies	unvetted-dep:mocha-jsdom	AI (dependencies): mocha-jsdom is listed as an optionalDependency used only in testing contexts; it is not a required runtime dep and poses minimal risk for this well-established Airbnb package.	ai	2026/04/22
dependencies	unvetted-dep:in-publish	AI (dependencies): in-publish is a standard build-time dependency used in config; appropriate for this package's context.	ai	2026/04/22
phantom-deps	phantom-dep:in-publish	AI (phantom-deps): in-publish is a phantom dep used in build config, not a direct import; normal pattern for build tooling.	ai	2026/04/22
dependencies	unvetted-dep:function.prototype.name	AI (dependencies): function.prototype.name is a well-known polyfill maintained by ljharb, the same publisher as enzyme. No security risk; stable false positive for this package.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): Legitimate maintainer transition to ljharb, a trusted long-standing publisher with strong track record.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): gdborton is a known Enzyme contributor; addition is consistent with the legitimate community maintainer transition of this package.	ai	2026/04/22
dependencies	unvetted-dep:object-is	AI (dependencies): object-is is a well-known ES6 polyfill maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:lodash.escape	AI (dependencies): lodash.escape is a well-known lodash utility with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:object.assign	AI (dependencies): object.assign is a well-known ES6 polyfill maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:object.values	AI (dependencies): object.values is a well-known ES6 polyfill maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:lodash.isequal	AI (dependencies): lodash.isequal is a well-known lodash utility with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:object.entries	AI (dependencies): object.entries is a well-known ES6 polyfill maintained by ljharb with no malicious history.	ai	2026/04/21
provenance	no-provenance	AI (provenance): Enzyme is a long-established package from a reputable publisher; lack of Sigstore provenance is not a meaningful risk signal here.	ai	2026/04/21
dependencies	unvetted-dep:is-number-object	AI (dependencies): is-number-object is a well-known utility maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:is-boolean-object	AI (dependencies): is-boolean-object is a well-known utility maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:rst-selector-parser	AI (dependencies): rst-selector-parser is a legitimate CSS selector parser used by enzyme with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:array.prototype.flat	AI (dependencies): array.prototype.flat is a well-known ES2019 polyfill maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:enzyme-shallow-equal	AI (dependencies): enzyme-shallow-equal is a legitimate companion package to enzyme with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:string.prototype.trim	AI (dependencies): string.prototype.trim is a well-known ES6 polyfill maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:html-element-map	AI (dependencies): html-element-map is a legitimate utility used by enzyme with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:has	AI (dependencies): has is a well-known, widely-used utility package with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:raf	AI (dependencies): raf is a well-known requestAnimationFrame polyfill with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:cheerio	AI (dependencies): cheerio is a widely-used HTML parsing library with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:is-regex	AI (dependencies): is-regex is a well-known utility maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:is-string	AI (dependencies): is-string is a well-known utility maintained by ljharb with no malicious history.	ai	2026/04/21
dependencies	unvetted-dep:is-subset	AI (dependencies): is-subset is a well-known utility with no malicious history.	ai	2026/04/21