mockttp
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:cors-gate | AI (dependencies): cors-gate is a legitimate CORS enforcement library; its use in an HTTP mock server is expected and stable. | ai | |
| phantom-deps | phantom-dep:@types/cors | AI (phantom-deps): @types/cors is a TypeScript type package legitimately declared as a runtime dep for type re-export; not directly imported as a module. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/node is a TypeScript type package used for Node.js type definitions; not directly imported as a module. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@httptoolkit/subscriptions-transport-ws | AI (dependencies): Same httptoolkit org as mockttp; first-party WebSocket subscriptions package. | ai | |
| dependencies | unvetted-dep:http-encoding | AI (dependencies): Legitimate HTTP content-encoding utility appropriate for an HTTP mock/proxy tool. | ai | |
| dependencies | unvetted-dep:milliparsec | AI (dependencies): HTTP body parser library; appropriate dependency for an HTTP mock server. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding in GraphQL scalar parseValue is standard for handling binary HTTP body data in a mock/proxy testing tool. No execution or exfiltration involved. | ai | |
| dependencies | unvetted-dep:parse-multipart-data | AI (dependencies): Multipart body parsing; appropriate for an HTTP mock server handling multipart requests. | ai | |
| dependencies | unvetted-dep:read-tls-client-hello | AI (dependencies): TLS inspection utility; appropriate for an HTTP proxy/mock tool that handles HTTPS. | ai | |
| dependencies | unvetted-dep:destroyable-server | AI (dependencies): Server lifecycle utility; appropriate for a test HTTP server library. | ai | |
| dependencies | unvetted-dep:@httptoolkit/util | AI (dependencies): Same httptoolkit org as mockttp; first-party utility package. | ai | |
| dependencies | unvetted-dep:@httptoolkit/httpolyglot | AI (dependencies): Same httptoolkit org as mockttp; first-party HTTP protocol detection package. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 4.4.2 | 47 / 56 | |
| 4.4.1 | 47 / 56 | |
| 4.4.0 | 47 / 56 | |
| 4.3.2 | 47 / 56 | |
| 4.3.1 | 41 / 56 | |
| 4.3.0 | 41 / 56 | |
| 4.2.3 | 44 / 57 | |
| 4.2.2 | 44 / 57 | |
| 4.2.1 | 45 / 56 | |
| 4.2.0 | 44 / 56 | |
| 4.1.0 | 44 / 56 | |
| 4.0.2 | 44 / 56 | |
| 4.0.1 | 44 / 56 | |
| 4.0.0 | 44 / 56 |
v4.4.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.3.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.3.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.