it
A testing framework for node
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:examples/requirejs/scripts/require.js | AI (source-diff): This is RequireJS 2.0.6 (header comment confirms it), a well-known AMD loader included as part of a browser example. Not malicious. | ai | |
| source-diff | net-exec-file:it.js | AI (source-diff): it.js is a browserify bundle of the testing framework itself. The require() shim pattern is standard browserify output, not malware. Explained by grunt-browserify devDependency. | ai | |
| source-diff | net-exec-file:examples/requirejs/scripts/it.js | AI (source-diff): Same browserify bundle as it.js, placed in the requirejs example directory. Legitimate browser build artifact. | ai | |
| email-domain | unclaimed-email:pollenware.com | AI (email-domain): Package is 14+ years old with a well-established publisher. Domain lapse is a theoretical risk but no active exploitation indicators exist for this dormant testing framework. | ai | |
| typosquat | typosquat.levenshtein:got | AI (typosquat): Package 'it' is a 2-char testing framework; Levenshtein match against 'got' is a false positive for such short names. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Package 'it' is a 2-char testing framework; Levenshtein match against 'pg' is a false positive for such short names. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Package 'it' is a 2-char testing framework; Levenshtein match against 'qs' is a false positive for such short names. | ai | |
| typosquat | typosquat.levenshtein:vite | AI (typosquat): Package 'it' is a 2-char testing framework predating vite by many years; Levenshtein match is a false positive for such short names. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change occurred in 2016 (9+ years ago); aheuermann has a strong track record (65 approved packages). Historical transition, not an active takeover signal. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is inside a bundled copy of RequireJS in the examples/ directory, not in the package's runtime code. Standard RequireJS behavior. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): glob is a legitimate declared dependency used by the CLI tooling; phantom-dep fires because it's not directly require()'d in source files. | ai | |
| phantom-deps | phantom-dep:grunt | AI (phantom-deps): grunt is a legitimate declared dependency used for build tasks; phantom-dep fires because it's not directly require()'d in source files. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): commander is a declared dependency used via CLI bin script; phantom-dep false positive for this package structure. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() usage is in jQuery v1.7.2 documentation asset, a well-known library. Not a security concern in this context. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is entirely due to documentation assets (Bootstrap CSS/JS, jQuery) added to docs/assets/. No runtime payload. | ai | |
| source-diff | net-exec-file:docs/assets/js/jquery.js | AI (source-diff): jQuery v1.7.2 documentation asset. Network/exec patterns are standard jQuery AJAX and eval-equivalent features, not malicious. | ai | |
| source-diff | obfuscated-file:docs/assets/js/jquery.js | AI (source-diff): File is jQuery v1.7.2, a well-known minified library added as a documentation asset. Not runtime code; minification is expected and benign. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 1.1.1 | 12 / 5 | |
| 1.1.0 | 12 / 5 | |
| 1.0.1 | 12 / 5 | |
| 1.0.0 | 12 / 5 | |
| 0.2.7 | 12 / 3 | |
| 0.2.6 | 12 / 3 | |
| 0.2.4 | 12 / 3 | |
| 0.2.3 | 12 / 3 | |
| 0.2.2 | 11 / 1 | |
| 0.2.1 | 11 / 1 | |
| 0.2.0 | 11 / 1 | |
| 0.1.1 | 2 / 0 | |
| 0.1.0 | 2 / 0 | |
| 0.0.5 | 2 / 0 | |
| 0.0.4 | 2 / 0 | |
| 0.0.3 | 2 / 0 | |
| 0.0.2 | 2 / 0 | |
| 0.0.1 | 2 / 0 |
v1.1.1
2 findingsThis version was published by a different npm account than previous versions on 2016-01-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-12-31. This could indicate a legitimate maintainer transition or an account compromise.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-12-15. This could indicate a legitimate maintainer transition or an account compromise.
v0.2.7
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.6
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.4
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.5
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Maintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.4
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
2 findingsMaintainer email '[email protected]' uses domain 'pollenware.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.