jasmine-reporters — Greenflagged

Reporters for the Jasmine BDD Framework

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

larrymyersbloveridge

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:ext/env.rhino.1.2.js	AI (source-diff): ext/env.rhino.1.2.js is the well-known Envjs browser environment emulator (by John Resig, MIT licensed), bundled for Rhino-based test execution. Long lines are inherent to its minified distribution format, not obfuscation.	ai	2026/04/24
source-diff	net-exec-file:ext/env.rhino.1.2.js	AI (source-diff): Envjs is a browser environment emulator that must simulate network (XHR) and dynamic code execution by design. This is expected behavior for this legitimate library, not dropper/loader malware.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): Size increase is fully explained by bundling of Rhino JAR, Envjs, and Jasmine — standard test-runner dependencies for headless Jasmine/Rhino execution. No injected payload.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): xmldom addition is justified by XML report generation functionality in this major version bump; not a suspicious injection.	ai	2026/04/24
source-diff	source-size-dropped	AI (source-diff): Diff is against v1.1.0 (major version gap); size reduction reflects legitimate v2.x restructuring, not a stub/redirect.	ai	2026/04/24
dependencies	unvetted-dep:xmldom	AI (dependencies): xmldom is a legitimate XML DOM library; jasmine-reporters uses it to generate JUnit XML output, making it a natural and expected runtime dependency.	ai	2026/04/24
source-diff	net-exec-file:lib/jasmine-2.0.0/jasmine.js	AI (source-diff): This is the bundled Jasmine 2.0.0 core library (MIT, Pivotal Labs). Network/exec pattern is Jasmine's module loading + timer eval — not malware. Stable false positive for this package.	ai	2026/04/24
semgrep	semgrep:eval-usage	AI (semgrep): eval() in jasmine.js is Jasmine core's intentional string-function execution for timer/clock mocking, acknowledged with jshint comments. Not a supply-chain risk.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Established package predating Sigstore provenance workflows; no CI/CD provenance is expected for this project's release process.	ai	2026/04/24

Versions (showing 28 of 28)

Version	Deps	Published
2.5.2	2 / 2	2022-11-04
2.5.1	2 / 2	2022-10-27
2.5.0	2 / 2	2021-08-31
2.3.2	2 / 2	2018-07-30
2.3.0	2 / 2	2017-12-29
2.2.1	2 / 1	2017-03-16
2.2.0	3 / 0	2016-06-18
2.1.1	1 / 0	2015-12-27
2.1.0	1 / 0	2015-12-23
2.0.8	1 / 0	2015-12-21
2.0.7	1 / 0	2015-06-28
2.0.6	1 / 0	2015-04-29
2.0.5	1 / 0	2015-03-09
2.0.4	1 / 0	2015-02-10
2.0.3	1 / 0	2014-07-24
2.0.2	1 / 0	2014-07-23
2.0.1	1 / 0	2014-07-16
2.0.0	1 / 0	2014-07-02
1.0.2	1 / 0	2015-04-29
1.0.1	1 / 0	2014-09-26
1.0.0	0 / 0	2014-07-02
0.4.1	0 / 0	2014-04-19
0.4.0	0 / 0	2014-03-23
0.3.2	0 / 0	2014-03-12
0.3.0	0 / 0	2014-02-28
0.2.1	0 / 0	2012-03-09
0.2.0	0 / 0	2012-01-31
0.1.0	0 / 0	2011-08-31

v2.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.7

2 findings

HIGH New file with network + code execution: lib/jasmine-2.0.0/jasmine.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.6

2 findings

HIGH New file with network + code execution: lib/jasmine-2.0.0/jasmine.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.4

2 findings

HIGH New file with network + code execution: lib/jasmine-2.0.0/jasmine.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

2 findings

HIGH New file with network + code execution: lib/jasmine-2.0.0/jasmine.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

2 findings

HIGH New file with network + code execution: lib/jasmine-2.0.0/jasmine.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

3 findings

HIGH New obfuscated file: ext/env.rhino.1.2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: ext/env.rhino.1.2.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.