mousetrap
Simple library for handling keyboard shortcuts
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | uncommon-license:Apache 2.0 | AI (license): Apache 2.0 is a standard permissive license; just uses non-SPDX format string. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed to ccampbell, the original author of mousetrap. Repo URL github.com/ccampbell/mousetrap confirms ownership. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): tjholowaychuk was a placeholder maintainer; removal during transfer to actual author is expected. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Transfer from tjholowaychuk to ccampbell (actual author per GitHub repo) is a legitimate ownership correction, not a hijack. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): ccampbell is the original author; zeke is a known npm community member who facilitated the transfer. | ai | |
| source-diff | net-exec-file:tests/libs/sinon-1.7.1.js | AI (source-diff): Sinon.JS is a well-known test double library; XHR faking and eval patterns are core to its functionality, not malware. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is from vendored test libraries (chai, sinon, mocha, jquery) in tests/libs/; stable for this package. | ai | |
| source-diff | net-exec-file:tests/libs/jquery-1.7.2.min.js | AI (source-diff): jQuery 1.7.2 minified is a well-known library vendored for tests; AJAX/eval patterns are inherent to jQuery, not malware. | ai | |
| source-diff | net-exec-file:tests/libs/chai-1.6.0.js | AI (source-diff): Chai.js is a well-known assertion library vendored in tests/libs/; network+exec patterns are inherent to the library, not malware. | ai |
Versions (showing 11 of 11)
| Version | Deps | Published |
|---|---|---|
| 1.6.5 | 0 / 7 | |
| 1.6.4 | 0 / 7 | |
| 1.6.3 | 0 / 7 | |
| 1.6.2 | 0 / 3 | |
| 1.6.1 | 0 / 3 | |
| 1.6.0 | 0 / 3 | |
| 1.5.3 | 0 / 3 | |
| 1.5.2 | 0 / 3 | |
| 1.5.1 | 0 / 3 | |
| 1.4.6 | 0 / 3 | |
| 0.0.1 | 0 / 0 |
v1.6.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.3
2 findingsThis version was published by a different npm account than previous versions on 2015-07-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.2
5 findingsAll previous maintainers (tjholowaychuk) were replaced by new maintainers (zeke, ccampbell). This is a strong signal of a potential package hijack and requires careful review.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.1
5 findingsAll previous maintainers (tjholowaychuk) were replaced by new maintainers (zeke, ccampbell). This is a strong signal of a potential package hijack and requires careful review.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.6
5 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Maintainer email '[email protected]' uses domain 'gravityonmars.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.