jest-mock — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aaronabramovsimenbrickhanloniiopenjs-operationscpojer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase is explained by the addition of the new browser-targeted ES5 bundle with polyfills, an intentional build artifact for jest-mock.	ai	2026/04/22
source-diff	net-exec-file:build-es5/index.js	AI (source-diff): build-es5/index.js is an intentional UMD/ES5 browser bundle (referenced in package.json 'browser' field). The 'network+exec' signals are UMD boilerplate (typeof window, define(factory)) — not actual network I/O or malicious code execution.	ai	2026/04/22
dependencies	unvetted-dep:@jest/types	AI (dependencies): @jest/types is a first-party sibling package in the jestjs/jest monorepo, always released in lockstep with jest-mock. Not a third-party unknown dependency.	ai	2026/04/22
dependencies	unvetted-dep:jest-util	AI (dependencies): jest-util is a first-party sibling package in the jestjs/jest monorepo, always released in lockstep with jest-mock. Not a third-party unknown dependency.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): @jest/types and @types/node are legitimate Jest ecosystem packages introduced in the v26 monorepo refactor; not suspicious.	ai	2026/04/22
source-diff	source-size-dropped	AI (source-diff): Size drop from v22 to v26 reflects intentional refactoring (type extraction to @jest/types, TypeScript adoption); not a stub replacement.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): simenb is a known Jest core contributor at Meta/Facebook; the publisher change from cpojer reflects a legitimate team transition, not a compromise.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers are known Jest team members at Meta/Facebook; consistent with legitimate team evolution across major versions.	ai	2026/04/22
maintainer-change	maintainer-removed	AI (maintainer-change): Removed maintainers reflect normal team turnover at Meta/Facebook; no signs of hostile takeover.	ai	2026/04/22
npm-metadata	suspicious-initial-version	AI (npm-metadata): jest-mock 0.0.0 is a well-known namespace reservation stub by the Jest core team (cpojer). The 0.0.0 version is intentional and not indicative of malicious activity.	ai	2026/04/22
provenance	no-provenance	AI (provenance): jest-mock is a long-established Facebook/Jest package; absence of Sigstore provenance is expected for packages of this age and is not a risk signal here.	ai	2026/04/22
semgrep	semgrep:new-function-constructor	AI (semgrep): jest-mock intentionally uses new Function() to create named mock constructors — a documented, stable internal pattern with no external input. Not a security risk for this package.	ai	2026/04/22
phantom-deps	phantom-dep:@jest/types	AI (phantom-deps): Type-only dependency; not directly imported at runtime is expected for TypeScript type packages in Jest's ecosystem.	ai	2026/04/21
npm-metadata	no-description	AI (npm-metadata): Jest monorepo packages routinely omit descriptions in published package.json; not a malware signal for this package.	ai	2026/04/21
bogus-package	bogus-package	AI (bogus-package): jest-mock is a core Jest monorepo package; inflated semver, missing description, and no keywords are expected artifacts of monorepo publishing, not spam indicators.	ai	2026/04/21
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): @types/node is a type-only dependency; not being directly imported at runtime is standard and expected.	ai	2026/04/21

Versions (showing 25 of 125)

Version	Deps	Published
19.0.0	0 / 0	2017-02-21
18.0.0	0 / 0	2016-12-15
17.0.2	0 / 0	2016-11-15
17.0.0	0 / 0	2016-11-08
16.0.2	0 / 0	2016-10-20
16.0.0	0 / 0	2016-10-03
15.0.0	0 / 0	2016-08-31
14.0.0	0 / 0	2016-07-27
13.2.2	0 / 0	2016-07-07
13.2.1	0 / 0	2016-07-07
13.1.1	0 / 0	2016-07-06
13.0.0	0 / 0	2016-06-22
12.1.0	0 / 0	2016-05-20
12.0.2	0 / 0	2016-04-28
12.0.1	0 / 0	2016-04-27
12.0.0	0 / 0	2016-04-27
11.0.2	0 / 0	2016-04-18
11.0.1	0 / 0	2016-04-15
11.0.0	0 / 0	2016-04-12
10.0.2	0 / 0	2016-04-11
10.0.1	0 / 0	2016-03-30
10.0.0	0 / 0	2016-03-30
9.0.3	0 / 0	2016-03-23
1.0.0	0 / 0	2016-03-18
0.0.0	0 / 0	2016-03-16

v19.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v18.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v17.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v17.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v16.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v16.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v15.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.2

2 findings

HIGH Publisher changed: cpojer → kentaromiura (on 2016-04-18) provenance

This version was published by a different npm account than previous versions on 2016-04-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.