should — Greenflagged

test framework agnostic BDD-style assertions

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

btdgjohnsontravisjeffery

Keywords

testbddassertshould

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): should-equal and should-format are first-party shouldjs org packages representing a documented modular refactor; not a supply-chain risk for this package.	ai	2026/04/22
source-diff	net-exec-file:es6/should.js	AI (source-diff): es6/should.js is a rollup-bundled ES6 build artifact generated by the package's own build scripts. The 'network + code execution' detection is a false positive on standard ES module imports and assertion library introspection patterns.	ai	2026/04/22
source-diff	net-exec-file:cjs/should.js	AI (source-diff): cjs/should.js is a rollup-bundled CJS build artifact generated by the package's own build scripts. The 'network + code execution' detection is a false positive on standard CommonJS require() calls and assertion library introspection patterns.	ai	2026/04/22
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require in a browserify bundle artifact; not a runtime arbitrary module loader. Stable false positive for this package.	ai	2026/04/22
source-diff	net-exec-file:should.js	AI (source-diff): should.js is a standard browserify UMD bundle (browser build artifact). The detected 'network+exec' pattern is the browserify module loader boilerplate, not malware. Stable false positive for this package.	ai	2026/04/22
maintainer-change	maintainer-removed	AI (maintainer-change): Original maintainers (tjholowaychuk, gjohnson, travisjeffery) voluntarily transferred the package to btd in 2014. Removal is part of the legitimate handoff.	ai	2026/04/22
maintainer-change	maintainer-takeover	AI (maintainer-change): btd is the well-documented legitimate successor maintainer of should.js, taking over from TJ Holowaychuk in 2014. This is a historical, benign transfer, not a hijack.	ai	2026/04/22
source-diff	source-size-tripled	AI (source-diff): Size increase is explained by addition of a bundled browser build (should.js, 58KB), standard practice for this library's 3.x release.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): Publisher change from tjholowaychuk to btd occurred in 2013 — a well-documented, decade-old legitimate maintainer transition for the should.js library.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers (gjohnson, travisjeffery, btd) were added as part of the same 2013 legitimate handoff; btd has a strong track record with 57 approved packages.	ai	2026/04/22
dependencies	unvetted-dep:should-type-adaptors	AI (dependencies): should-type-adaptors is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk.	ai	2026/04/21
dependencies	unvetted-dep:should-type	AI (dependencies): should-type is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk.	ai	2026/04/21
provenance	no-provenance	AI (provenance): Established package predating Sigstore provenance; no provenance is expected and not a risk signal here.	ai	2026/04/21
dependencies	unvetted-dep:should-equal	AI (dependencies): should-equal is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk.	ai	2026/04/21
dependencies	unvetted-dep:should-format	AI (dependencies): should-format is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk.	ai	2026/04/21
dependencies	unvetted-dep:should-util	AI (dependencies): should-util is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk.	ai	2026/04/21