should
test framework agnostic BDD-style assertions
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): should-equal and should-format are first-party shouldjs org packages representing a documented modular refactor; not a supply-chain risk for this package. | ai | |
| source-diff | net-exec-file:es6/should.js | AI (source-diff): es6/should.js is a rollup-bundled ES6 build artifact generated by the package's own build scripts. The 'network + code execution' detection is a false positive on standard ES module imports and assertion library introspection patterns. | ai | |
| source-diff | net-exec-file:cjs/should.js | AI (source-diff): cjs/should.js is a rollup-bundled CJS build artifact generated by the package's own build scripts. The 'network + code execution' detection is a false positive on standard CommonJS require() calls and assertion library introspection patterns. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in a browserify bundle artifact; not a runtime arbitrary module loader. Stable false positive for this package. | ai | |
| source-diff | net-exec-file:should.js | AI (source-diff): should.js is a standard browserify UMD bundle (browser build artifact). The detected 'network+exec' pattern is the browserify module loader boilerplate, not malware. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Original maintainers (tjholowaychuk, gjohnson, travisjeffery) voluntarily transferred the package to btd in 2014. Removal is part of the legitimate handoff. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): btd is the well-documented legitimate successor maintainer of should.js, taking over from TJ Holowaychuk in 2014. This is a historical, benign transfer, not a hijack. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is explained by addition of a bundled browser build (should.js, 58KB), standard practice for this library's 3.x release. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from tjholowaychuk to btd occurred in 2013 — a well-documented, decade-old legitimate maintainer transition for the should.js library. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (gjohnson, travisjeffery, btd) were added as part of the same 2013 legitimate handoff; btd has a strong track record with 57 approved packages. | ai | |
| dependencies | unvetted-dep:should-type-adaptors | AI (dependencies): should-type-adaptors is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:should-type | AI (dependencies): should-type is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| provenance | no-provenance | AI (provenance): Established package predating Sigstore provenance; no provenance is expected and not a risk signal here. | ai | |
| dependencies | unvetted-dep:should-equal | AI (dependencies): should-equal is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:should-format | AI (dependencies): should-format is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:should-util | AI (dependencies): should-util is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai |
Versions (showing 51 of 113)
| Version | Deps | Published |
|---|---|---|
| 13.2.3 | 5 / 11 | |
| 13.2.2 | 5 / 11 | |
| 13.2.1 | 5 / 11 | |
| 13.2.0 | 5 / 11 | |
| 13.1.3 | 5 / 11 | |
| 13.1.2 | 5 / 11 | |
| 13.1.1 | 5 / 11 | |
| 13.1.0 | 5 / 11 | |
| 13.0.1 | 5 / 11 | |
| 13.0.0 | 5 / 11 | |
| 12.0.0 | 5 / 9 | |
| 11.2.1 | 5 / 8 | |
| 11.2.0 | 5 / 8 | |
| 11.1.2 | 5 / 8 | |
| 11.1.1 | 5 / 8 | |
| 11.1.0 | 5 / 8 | |
| 11.0.0 | 5 / 8 | |
| 10.0.0 | 3 / 7 | |
| 9.0.2 | 3 / 7 | |
| 9.0.1 | 3 / 7 | |
| 9.0.0 | 3 / 7 | |
| 8.4.0 | 3 / 15 | |
| 8.3.2 | 3 / 15 | |
| 8.3.1 | 3 / 15 | |
| 8.3.0 | 3 / 12 | |
| 8.2.2 | 3 / 12 | |
| 8.2.1 | 3 / 13 | |
| 8.2.0 | 3 / 13 | |
| 8.1.1 | 3 / 13 | |
| 8.1.0 | 3 / 13 | |
| 8.0.2 | 3 / 13 | |
| 8.0.1 | 3 / 13 | |
| 8.0.0 | 3 / 13 | |
| 7.1.1 | 3 / 11 | |
| 7.1.0 | 3 / 11 | |
| 7.0.4 | 3 / 11 | |
| 7.0.3 | 3 / 11 | |
| 7.0.2 | 3 / 11 | |
| 7.0.1 | 3 / 11 | |
| 7.0.0 | 3 / 11 | |
| 6.0.3 | 3 / 12 | |
| 6.0.2 | 3 / 12 | |
| 6.0.1 | 3 / 12 | |
| 6.0.0 | 3 / 12 | |
| 5.2.0 | 3 / 11 | |
| 5.1.0 | 3 / 11 | |
| 5.0.1 | 3 / 11 | |
| 5.0.0 | 3 / 11 | |
| 4.6.5 | 3 / 11 | |
| 4.6.4 | 3 / 11 | |
| 4.6.3 | 3 / 11 |
v13.2.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.2.1
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.2.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.2
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.1
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.2
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.1
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.