← Home

jsdom

npm Repository Homepage

A JavaScript implementation of many web standards

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

timothygudomenicsebmasterzirrotmpvarjoris-van-der-wel

Keywords

domhtmlwhatwgw3c

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): tmpvar handed off jsdom to domenic; this is a well-known legitimate maintainer transition from 2014. ai
maintainer-change maintainer-takeover AI (maintainer-change): Transition from tmpvar to domenic is legitimate; both listed in package.json, domenic is established ecosystem publisher with strong track record. ai
semgrep semgrep:base64-decode AI (semgrep): jsdom must decode base64 data URIs as part of its browser emulation; this is core functionality, not a malicious payload. ai
phantom-deps phantom-dep:iconv-lite AI (phantom-deps): iconv-lite is properly declared in package.json and used for encoding handling; false positive phantom-dep classification. ai
phantom-deps phantom-dep:cssstyle-browserify AI (phantom-deps): Not directly imported because it's a browser-field substitution for cssstyle in browserify builds, not a Node.js import. ai
npm-metadata url-dep:cssstyle-browserify AI (npm-metadata): cssstyle-browserify is a browser-only shim used via browserify's browser field substitution, not in the Node.js runtime path. Git URL dep is a 2014-era pattern for browser shims in jsdom. ai
dependencies unvetted-dep:cssstyle-browserify AI (dependencies): Browser-only shim dependency via git URL; not used in Node.js runtime path. Acceptable for jsdom's browser build support. ai
source-diff net-exec-file:lib/jsdom/living/helpers/create-event-accessor.js AI (source-diff): File implements standard event handler logic using legitimate Node.js APIs; no actual network calls or dynamic code execution present. ai
source-diff source-size-tripled AI (source-diff): 3x size increase reflects major version upgrade with additional standards compliance; consistent with jsdom's development trajectory. ai
source-diff large-new-source-files AI (source-diff): Major version bump with expanded DOM/HTML standards implementation; large source additions are expected and legitimate. ai
publish-pattern new-deps-added AI (publish-pattern): New dependencies are established DOM-related libraries (cssom, cssstyle, nwmatcher, htmlparser, contextify, request); expected for DOM implementation. ai
phantom-deps phantom-dep:browser-request AI (phantom-deps): browser-request is correctly mapped in package.json's 'browser' field for dual-environment support; not a phantom dep. ai
maintainer-change maintainer-added AI (maintainer-change): Domenic Denicola is a legitimate co-maintainer with strong npm history; documented transition in package.json. ai
source-diff source-size-dropped AI (source-diff): Source size reduction reflects refactoring and modularization, consistent with jsdom's architecture; not indicative of stub replacement. ai
dependencies unvetted-dep:request AI (dependencies): request is a well-established HTTP library; used legitimately for XHR implementation in jsdom. ai
provenance no-provenance AI (provenance): Package predates Sigstore adoption; absence of provenance is common for established packages. ai
semgrep semgrep:new-function-constructor AI (semgrep): new Function() in vm-shim.js is jsdom's documented pattern for executing code in a sandboxed VM context; not a code injection vulnerability. ai
dependencies unvetted-dep:mjsunit.runner AI (dependencies): mjsunit.runner is a test runner dependency; unvetted status is expected and acceptable for test infrastructure. ai
phantom-deps phantom-dep:mjsunit.runner AI (phantom-deps): Test runner referenced in config but not directly imported in source code; stable pattern for this package. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require for feature-loading in DOM library is standard pattern, not malware indicator. ai
provenance publisher-changed AI (provenance): Publisher change (tmpvar → domenic) on 2013-05-21 is a documented, legitimate maintainer transition; both remain as maintainers. ai
dependencies unvetted-dep:undici AI (dependencies): undici is the official Node.js HTTP client maintained by the Node.js core team; a legitimate, well-established dependency. ai
provenance slsa-provenance AI (provenance): SLSA provenance attestation is present and valid; this is a strong supply chain integrity signal for jsdom's CI-based publishing model. ai
semgrep semgrep:child-process-import AI (semgrep): spawnSync in xmlhttprequest.js is legitimate DOM implementation detail, not a malware indicator. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get in proxy handlers is standard DOM implementation pattern for attribute access interception; not obfuscation. ai

Versions (showing 51 of 51)

Version Deps Published
29.1.1 21 / 20
29.1.0 21 / 20
29.0.2 21 / 20
29.0.1 21 / 20
29.0.0 21 / 20
28.1.0 21 / 17
28.0.0 20 / 15
27.4.0 20 / 14
27.3.0 20 / 14
27.2.0 20 / 14
27.1.0 20 / 14
27.0.1 20 / 14
27.0.0 20 / 14
26.1.0 20 / 13
26.0.0 21 / 13
25.0.1 21 / 13
25.0.0 21 / 13
24.1.3 21 / 13
24.1.2 21 / 13
24.1.1 21 / 13
24.1.0 21 / 13
24.0.0 21 / 13
23.2.0 21 / 13
23.1.0 21 / 13
23.0.1 21 / 14
23.0.0 21 / 14
22.1.0 23 / 14
22.0.0 23 / 14
21.1.2 26 / 22
21.1.1 26 / 22
21.1.0 26 / 22
21.0.0 26 / 22
20.0.3 26 / 22
20.0.2 26 / 22
20.0.1 26 / 22
20.0.0 27 / 22
19.0.0 27 / 22
18.1.1 27 / 22
18.1.0 27 / 22
18.0.1 27 / 22
18.0.0 27 / 22
17.0.0 27 / 22
16.7.0 27 / 22
16.6.0 27 / 22
8.3.1 16 / 26
7.2.2 15 / 16
1.4.1 9 / 11
0.10.0 7 / 3
0.2.3 4 / 3
0.1.23 1 / 0
0.1.22 1 / 0

v29.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v29.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v29.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v29.0.1

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: domenic → GitHub Actions (on 2026-03-20) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.

v28.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v25.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v25.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.0.1

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v22.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v22.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.0.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.0.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v18.1.1

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v18.1.0

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v18.0.1

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v18.0.0

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v17.0.0

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v16.7.0

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v16.6.0

2 findings
HIGH New file with network + code execution: lib/jsdom/living/helpers/create-event-accessor.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.3.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.2.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: tmpvar → domenic (on 2014-12-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-12-07. This could indicate a legitimate maintainer transition or an account compromise.

v0.10.0

3 findings
HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (tmpvar) were replaced by new maintainers (domenic). This is a strong signal of a potential package hijack and requires careful review.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: tmpvar → domenic (on 2014-02-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-02-07. This could indicate a legitimate maintainer transition or an account compromise.

v0.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.