expect
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall script is minimal and auditable; stable pattern for this assertion library package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import in postinstall is used for build automation, not malicious code execution or data exfiltration. | ai | |
| source-diff | obfuscated-file:build-es5/index.js | AI (source-diff): build-es5/index.js is a legitimate UMD browser bundle (rollup/webpack output with core-js polyfills) explicitly referenced in package.json's 'browser' field. Not obfuscation. | ai | |
| phantom-deps | phantom-dep:jest-regex-util | AI (phantom-deps): jest-regex-util is explicitly declared in package.json dependencies and is a legitimate Jest monorepo sub-package; false positive for this package. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in Jest's ES5 browser build is a standard callback coercion pattern in a testing library; input is controlled by the test author, not external parties. | ai | |
| source-diff | net-exec-file:umd/expect.min.js | AI (source-diff): Standard webpack UMD minified bundle produced by documented build scripts. The 'network calls' and 'dynamic code execution' are webpack's module system boilerplate, not malware. Identical pattern to already-accepted umd/expect.js. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Package growth over time; 24 new files reflect normal refactoring, not injection. | ai | |
| source-diff | net-exec-file:umd/expect.js | AI (source-diff): File is webpack-bundled UMD output with standard module-loading boilerplate, not malware. Minified bundles inherently contain dynamic code patterns. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (is-regexp, deep-equal, object-inspect) are established utility packages. | ai | |
| provenance | publisher-changed | AI (provenance): Historical transition in 2015; mjackson has maintained the package cleanly for nearly a decade. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are Facebook/Jest core team members (cpojer, dmitriiabramov, fb, etc.) — legitimate transfer. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects legitimate package maturation and feature additions. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Original placeholder maintainer removed as part of legitimate Facebook/Jest namespace acquisition. | ai | |
| source-diff | net-exec-file:build-es5/index.js | AI (source-diff): Same UMD browser bundle; network/exec patterns are from bundled browser polyfills (core-js), not malicious dropper behavior. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Transition occurred in 2015 (9 years ago); mjackson is established publisher with strong track record. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is the legitimate initial release of a 14-year-old test library with 257 subsequent versions; not a malicious throwaway package. | ai | |
| dependencies | unvetted-dep:jest-util | AI (dependencies): jest-util is a sibling Jest monorepo package released in lockstep; its presence as a dependency of expect is expected and legitimate. | ai | |
| dependencies | unvetted-dep:jest-mock | AI (dependencies): jest-mock is a sibling Jest monorepo package released in lockstep; its presence as a dependency of expect is expected and legitimate. | ai | |
| bogus-package | bogus-package | AI (bogus-package): expect is a core Jest monorepo package with 257 versions and 5258 days of history; bogus-package signals are false positives for this well-known sub-package. | ai | |
| dependencies | unvetted-dep:jest-message-util | AI (dependencies): jest-message-util is a sibling Jest monorepo package released in lockstep; its presence as a dependency of expect is expected and legitimate. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Missing description is typical of Jest monorepo sub-packages; not a malicious indicator for this established package. | ai |
Versions (showing 57 of 157)
| Version | Deps | Published |
|---|---|---|
| 23.3.0 | 6 / 0 | |
| 23.2.0 | 6 / 0 | |
| 23.1.0 | 6 / 0 | |
| 23.0.1 | 6 / 0 | |
| 23.0.0 | 6 / 0 | |
| 22.4.3 | 6 / 0 | |
| 22.4.0 | 6 / 0 | |
| 22.3.0 | 6 / 0 | |
| 22.2.2 | 6 / 0 | |
| 22.2.0 | 6 / 0 | |
| 22.1.0 | 6 / 0 | |
| 22.0.6 | 6 / 0 | |
| 22.0.5 | 6 / 0 | |
| 22.0.3 | 6 / 0 | |
| 22.0.2 | 6 / 0 | |
| 22.0.1 | 6 / 0 | |
| 22.0.0 | 6 / 0 | |
| 21.2.1 | 6 / 0 | |
| 21.2.0 | 6 / 0 | |
| 21.1.0 | 6 / 0 | |
| 21.0.2 | 6 / 0 | |
| 21.0.0 | 6 / 0 | |
| 1.20.2 | 7 / 23 | |
| 1.20.1 | 7 / 20 | |
| 1.20.0 | 7 / 20 | |
| 1.19.0 | 7 / 20 | |
| 1.18.0 | 6 / 19 | |
| 1.17.0 | 5 / 19 | |
| 1.16.0 | 3 / 19 | |
| 1.15.2 | 3 / 19 | |
| 1.15.1 | 3 / 19 | |
| 1.15.0 | 3 / 19 | |
| 1.14.0 | 3 / 16 | |
| 1.13.4 | 3 / 16 | |
| 1.13.3 | 3 / 16 | |
| 1.13.2 | 3 / 17 | |
| 1.13.1 | 3 / 16 | |
| 1.12.0 | 3 / 12 | |
| 1.11.1 | 3 / 13 | |
| 1.11.0 | 3 / 13 | |
| 1.10.0 | 3 / 13 | |
| 1.9.0 | 1 / 9 | |
| 1.8.0 | 1 / 9 | |
| 1.7.0 | 1 / 9 | |
| 1.6.0 | 0 / 9 | |
| 1.5.0 | 0 / 9 | |
| 1.4.0 | 0 / 9 | |
| 1.3.0 | 0 / 9 | |
| 1.2.0 | 0 / 9 | |
| 1.1.0 | 0 / 1 | |
| 1.0.2 | 0 / 1 | |
| 1.0.1 | 0 / 1 | |
| 1.0.0 | 0 / 1 | |
| 0.1.1 | 0 / 1 | |
| 0.1.0 | 0 / 1 | |
| 0.0.2 | 0 / 0 | |
| 0.0.0 | 0 / 0 |
v23.3.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-07-04. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.2.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-06-25. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.1.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-05-30. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.1
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-05-27. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-05-24. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.4.3
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-03-21. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.4.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-02-20. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.3.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-02-13. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.2.2
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-02-09. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.2.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, ljharb, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-02-07. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.1.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-01-15. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.6
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-01-11. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.5
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-01-09. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.3
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-12-19. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.2
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-12-19. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.1
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-12-18. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, jeanlauliac, mjesun, dmitriiabramov, fb, cpojer, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-12-18. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.1
4 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-09-27. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.0
4 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-09-26. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.1.0
4 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-09-14. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.0.2
4 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-09-08. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.0.0
4 findingsAll previous maintainers (onirame) were replaced by new maintainers (cpojer, dmitriiabramov, fb, jeanlauliac, mjackson, mjesun). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2017-09-04. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.2
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-06-29. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.1
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-05-08. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-05-07. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-05-02. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.0
5 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-04-19. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
4 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-04-19. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-03-23. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.2
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (ljharb, mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.1
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.0
4 findingsScript: node ./npm-scripts/postinstall.js
All previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-02-01. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.4
4 findingsScript: node ./npm-scripts/postinstall.js
All previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-12-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.3
4 findingsScript: node ./npm-scripts/postinstall.js
All previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-12-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.2
4 findingsScript: node ./npm-scripts/postinstall.js
All previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-12-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.1
5 findingsScript: node ./npm-scripts/postinstall.js
All previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-12-10. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-10-05. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-09-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-09-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-09-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-08-12. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-07-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-07-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-02-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-01-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-01-19. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-12-31. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-12-31. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-12-03. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-11-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-11-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-11-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
3 findingsAll previous maintainers (onirame) were replaced by new maintainers (mjackson). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-03-10. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.