← Home

mocha

npm Repository Homepage

simple, flexible, fun test framework

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

voxpellijoshuakgoldbergmark-wiemer

Keywords

mochatestbddtddtaptestingchaiassertionavajesttapejasminekarma

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): joshuakgoldberg is a known mocha maintainer; legitimate transition within the mochajs org. ai
semgrep semgrep:child-process-import AI (semgrep): Mocha's CLI spawns child processes to run tests with node options — core functionality. ai
provenance no-provenance AI (provenance): Informational only; mocha is a well-established package with verified maintainers. ai
semgrep semgrep:env-spread AI (semgrep): Standard pattern for passing env to child worker processes in mocha's parallel execution; present since parallel support was added. ai
semgrep semgrep:dynamic-require AI (semgrep): Mocha is a test runner that dynamically loads configs, test files, reporters, and interfaces by design. ai
semgrep semgrep:eval-usage AI (semgrep): Deserializes options from mocha's own serialize-javascript output in worker IPC; not user-controlled input. ai

Versions (showing 51 of 218)

Hide prereleases View all versions
Version Deps Published
11.7.6 21 / 62
11.7.5 21 / 61
11.7.4 21 / 61
11.7.3 20 / 61
11.7.2 20 / 61
11.7.1 20 / 56
11.7.0 20 / 56
11.6.0 20 / 56
11.5.0 20 / 56
11.4.0 20 / 56
11.3.0 20 / 56
11.2.2 20 / 55
11.2.1 20 / 55
11.2.0 20 / 55
11.1.0 20 / 54
11.0.2 20 / 55
11.0.1 20 / 55
11.0.0 20 / 55
10.8.2 20 / 54
10.8.1 20 / 54
10.8.0 20 / 54
10.7.3 20 / 54
10.7.0 20 / 60
10.6.1 20 / 60
10.6.0 20 / 61
10.5.2 20 / 61
10.5.1 20 / 61
10.5.0 20 / 61
10.4.0 20 / 62
10.3.0 20 / 66
10.2.0 21 / 70
10.1.0 21 / 73
10.0.0 22 / 73
9.2.2 24 / 79
9.2.1 24 / 79
9.2.0 24 / 79
9.1.4 24 / 80
9.1.3 24 / 81
9.1.2 24 / 81
9.1.1 25 / 82
9.1.0 25 / 82
9.0.3 25 / 85
9.0.2 25 / 85
9.0.1 25 / 85
9.0.0 25 / 85
8.4.0 25 / 81
8.3.2 25 / 81
8.3.1 25 / 81
8.3.0 25 / 81
8.2.1 25 / 80
8.2.0 25 / 80

v11.7.6

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: GitHub Actions → joshuakgoldberg (on 2026-05-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.

v11.7.5

2 findings
HIGH env-spread: lib/nodejs/buffered-worker-pool.js:90 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/mochajs/mocha/blob/9a6a5db8401dec63ea81093dd862e9e9b13b44d0/lib/nodejs/buffered-worker-pool.js#L90 88 | ...forkOpts, 89 | // adds an incremental id to all workers, which can be useful to allocate resources for each process > 90 | env: {...process.env, MOCHA_WORKER_ID: counter++} 91 | } 92 | };

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.7.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.2.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.2.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.8.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.8.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.7.3

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: joshuakgoldberg → voxpelli (on 2024-08-09) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-08-09. This could indicate a legitimate maintainer transition or an account compromise.

v10.7.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.6.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.5.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.5.1

2 findings
HIGH Publisher changed: voxpelli → joshuakgoldberg (on 2024-06-25) provenance

This version was published by a different npm account than previous versions on 2024-06-25. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.5.0

2 findings
HIGH Publisher changed: voxpelli → joshuakgoldberg (on 2024-06-24) provenance

This version was published by a different npm account than previous versions on 2024-06-24. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.4.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: joshuakgoldberg → voxpelli (on 2024-03-26) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-26. This could indicate a legitimate maintainer transition or an account compromise.

v10.3.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: juergba → joshuakgoldberg (on 2024-02-08) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-02-08. This could indicate a legitimate maintainer transition or an account compromise.

v10.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.