tape
tap-producing test harness for node and browsers
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): [email protected] is the legitimate first release of the well-known TAP test harness by substack, published ~13 years ago. The 0.0.0 version reflects early release conventions, not malicious intent. | ai | |
| provenance | publisher-changed | AI (provenance): substack (James Halliday) is the original author of tape; the change from domenic back to substack is a legitimate maintainer transition, not a compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): ljharb is a well-known, trusted npm ecosystem contributor; this addition is a legitimate maintainer expansion for tape. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): function-bind and has are foundational, widely-trusted utility packages with no malicious history; their addition is consistent with normal library evolution. | ai | |
| phantom-deps | phantom-dep:minimatch | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is uncommon (~12% adoption); not a disqualifier for established packages with long history and trusted publishers. | ai | |
| dependencies | unvetted-dep:resumer | AI (dependencies): resumer is a known transitive dependency; tape's 4895-day history and ecosystem trust mitigate unvetted-dep risk. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| phantom-deps | phantom-dep:resolve | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| phantom-deps | phantom-dep:minimist | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| phantom-deps | phantom-dep:dotignore | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| phantom-deps | phantom-dep:object.assign | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| phantom-deps | phantom-dep:has-dynamic-import | AI (phantom-deps): Build/config dependency; stable pattern for tape across versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Legitimate dual-module-system support (import vs require); controlled variable, not user input. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): tape is a distinct, well-known testing framework; no brand confusion with hapi despite edit distance. | ai |
Versions (showing 51 of 152)
| Version | Deps | Published |
|---|---|---|
| 5.9.0 | 22 / 20 | |
| 5.8.1 | 22 / 20 | |
| 5.8.0 | 22 / 19 | |
| 5.7.5 | 22 / 20 | |
| 5.7.4 | 22 / 20 | |
| 5.7.3 | 22 / 19 | |
| 5.7.2 | 22 / 18 | |
| 5.7.1 | 22 / 18 | |
| 5.7.0 | 22 / 18 | |
| 5.6.6 | 21 / 17 | |
| 5.6.5 | 21 / 17 | |
| 5.6.4 | 21 / 17 | |
| 5.6.3 | 21 / 16 | |
| 5.6.2 | 21 / 16 | |
| 5.6.1 | 21 / 16 | |
| 5.6.0 | 21 / 15 | |
| 5.5.3 | 21 / 14 | |
| 5.5.2 | 21 / 13 | |
| 5.5.1 | 22 / 13 | |
| 5.5.0 | 21 / 13 | |
| 5.4.1 | 21 / 13 | |
| 5.4.0 | 19 / 13 | |
| 5.3.2 | 19 / 13 | |
| 5.3.1 | 19 / 13 | |
| 5.3.0 | 19 / 13 | |
| 5.2.2 | 17 / 11 | |
| 5.2.1 | 17 / 11 | |
| 5.2.0 | 17 / 11 | |
| 5.1.1 | 17 / 9 | |
| 5.1.0 | 17 / 8 | |
| 5.0.1 | 17 / 8 | |
| 5.0.0 | 17 / 8 | |
| 4.17.0 | 16 / 17 | |
| 4.16.2 | 15 / 16 | |
| 4.16.1 | 15 / 16 | |
| 4.16.0 | 15 / 14 | |
| 4.15.1 | 15 / 14 | |
| 4.15.0 | 15 / 13 | |
| 4.14.0 | 15 / 13 | |
| 4.13.3 | 15 / 8 | |
| 4.13.2 | 15 / 7 | |
| 4.13.0 | 15 / 7 | |
| 4.12.1 | 14 / 7 | |
| 4.12.0 | 14 / 7 | |
| 4.11.0 | 13 / 7 | |
| 4.10.2 | 13 / 7 | |
| 4.10.1 | 13 / 7 | |
| 4.10.0 | 13 / 7 | |
| 4.9.2 | 13 / 7 | |
| 4.9.1 | 13 / 7 | |
| 4.9.0 | 13 / 5 |
v5.6.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.