nightmare
A high-level browser automation library.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance by years; absence is expected for this ecosystem-established library. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from stephenmathieson to mattmueller occurred in 2018; mattmueller has a long established track record. Historical transition, not an active takeover signal. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): proc.spawn(electron_path) is how Nightmare launches the browser process; this is the library's core design. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is used to inject DOM-querying functions into Electron renderer context — core browser automation functionality, not a supply-chain risk. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is used to register user-defined actions in the Electron renderer — part of Nightmare's documented extensibility API. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require resolves package.json for version reading — a benign and common pattern. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used to spawn Electron — the fundamental mechanism of this browser automation library. | ai |
Versions (showing 63 of 63)
| Version | Deps | Published |
|---|---|---|
| 3.0.2 | 14 / 18 | |
| 3.0.1 | 14 / 18 | |
| 3.0.0 | 14 / 18 | |
| 2.3.4 | 14 / 11 | |
| 2.2.0 | 13 / 8 | |
| 2.0.9 | 12 / 8 | |
| 2.0.8 | 12 / 7 | |
| 2.0.7 | 11 / 8 | |
| 2.0.6 | 11 / 8 | |
| 2.0.5 | 11 / 9 | |
| 2.0.4 | 11 / 9 | |
| 2.0.3 | 11 / 9 | |
| 2.0.2 | 11 / 9 | |
| 2.0.1 | 11 / 9 | |
| 2.0.0 | 11 / 9 | |
| 1.8.2 | 6 / 8 | |
| 1.8.1 | 6 / 8 | |
| 1.8.0 | 5 / 8 | |
| 1.7.0 | 5 / 3 | |
| 1.6.5 | 5 / 3 | |
| 1.6.4 | 5 / 3 | |
| 1.6.3 | 5 / 3 | |
| 1.6.2 | 5 / 2 | |
| 1.6.1 | 5 / 2 | |
| 1.6.0 | 5 / 2 | |
| 1.5.3 | 5 / 2 | |
| 1.5.2 | 5 / 2 | |
| 1.5.1 | 5 / 2 | |
| 1.5.0 | 5 / 2 | |
| 1.4.0 | 5 / 2 | |
| 1.3.3 | 5 / 2 | |
| 1.3.2 | 5 / 2 | |
| 1.3.1 | 5 / 2 | |
| 1.3.0 | 5 / 2 | |
| 1.2.0 | 5 / 2 | |
| 1.1.1 | 5 / 2 | |
| 1.1.0 | 5 / 2 | |
| 1.0.4 | 5 / 2 | |
| 1.0.3 | 5 / 2 | |
| 1.0.2 | 4 / 2 | |
| 1.0.1 | 5 / 2 | |
| 1.0.0 | 5 / 2 | |
| 0.1.7 | 5 / 2 | |
| 0.1.6 | 5 / 2 | |
| 0.1.5 | 5 / 2 | |
| 0.1.4 | 5 / 2 | |
| 0.1.3 | 5 / 2 | |
| 0.1.2 | 5 / 2 | |
| 0.1.1 | 5 / 2 | |
| 0.1.0 | 5 / 2 | |
| 0.0.13 | 5 / 2 | |
| 0.0.12 | 5 / 2 | |
| 0.0.11 | 5 / 2 | |
| 0.0.10 | 5 / 2 | |
| 0.0.9 | 5 / 2 | |
| 0.0.8 | 5 / 2 | |
| 0.0.7 | 5 / 2 | |
| 0.0.6 | 5 / 2 | |
| 0.0.5 | 5 / 2 | |
| 0.0.4 | 5 / 2 | |
| 0.0.3 | 5 / 2 | |
| 0.0.2 | 5 / 2 | |
| 0.0.1 | 5 / 2 |
v3.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
2 findingsThis version was published by a different npm account than previous versions on 2018-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.8
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-11-25. This could indicate a legitimate maintainer transition or an account compromise.
v2.0.7
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-10-01. This could indicate a legitimate maintainer transition or an account compromise.
v2.0.6
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-09-26. This could indicate a legitimate maintainer transition or an account compromise.
v2.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-09-13. This could indicate a legitimate maintainer transition or an account compromise.