testem

Test'em 'scripts! Javascript Unit testing made easy.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Established package with long history; provenance is a best-practice enhancement, not a blocker.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): step2yeung added as maintainer is a legitimate transition; long-standing contributor with clean track record.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): step2yeung is a known testem/Ember ecosystem contributor with 310 approved packages; legitimate maintainer transition from stefanpenner.	ai	2026/04/24
dependencies	unvetted-dep:xmldom	AI (dependencies): xmldom is a legitimate XML parsing dependency used in testem's browser testing infrastructure; its presence is expected and stable across versions.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): Dependency change consolidates multiple lodash sub-packages into the canonical lodash package — a routine refactoring with no security concern for this well-established test runner.	ai	2026/04/24
dependencies	unvetted-dep:http-proxy	AI (dependencies): http-proxy is a long-standing, widely-used reverse proxy package; its use in testem for proxying test requests is expected and legitimate.	ai	2026/04/23
phantom-deps	phantom-dep:rimraf	AI (phantom-deps): rimraf is declared and referenced in config; phantom-dep annotation is a false positive for this use case.	ai	2026/04/23
phantom-deps	phantom-dep:mustache	AI (phantom-deps): mustache is declared and referenced in config; phantom-dep annotation is a false positive for this use case.	ai	2026/04/23
semgrep	semgrep:env-bulk-read	AI (semgrep): Enumerating process.env for PATH variable is standard CLI tool pattern for cross-platform compatibility.	ai	2026/04/23
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require for user config files is legitimate for a testing framework; path is controlled via resolveConfigPath().	ai	2026/04/23

Version	Deps	Published
0.0.56	13 / 5	2012-06-27
0.0.55	13 / 5	2012-06-27
0.0.54	13 / 5	2012-06-22
0.0.53	13 / 5	2012-06-15
0.0.52	13 / 5	2012-06-14
0.0.51	13 / 5	2012-06-14
0.0.50	13 / 5	2012-06-13
0.0.49	13 / 5	2012-06-11
0.0.48	13 / 5	2012-06-11
0.0.47	13 / 5	2012-06-11
0.0.46	13 / 5	2012-06-11
0.0.45	13 / 5	2012-06-11
0.0.44	13 / 5	2012-06-09
0.0.43	13 / 5	2012-06-06
0.0.42	13 / 5	2012-06-06
0.0.41	13 / 5	2012-06-04
0.0.40	11 / 5	2012-05-15
0.0.39	11 / 5	2012-05-15
0.0.38	11 / 5	2012-05-15
0.0.37	11 / 5	2012-05-14
0.0.36	11 / 5	2012-05-14
0.0.35	11 / 5	2012-05-13
0.0.34	11 / 5	2012-05-12
0.0.33	11 / 5	2012-05-11
0.0.32	11 / 5	2012-05-10
0.0.31	11 / 5	2012-05-03
0.0.30	11 / 5	2012-05-03
0.0.28	11 / 5	2012-04-30
0.0.27	11 / 5	2012-04-25
0.0.26	11 / 5	2012-04-25
0.0.25	11 / 5	2012-04-24
0.0.24	11 / 5	2012-04-23
0.0.23	11 / 5	2012-04-23
0.0.22	11 / 5	2012-04-23
0.0.21	11 / 5	2012-04-23
0.0.20	11 / 5	2012-04-20
0.0.19	11 / 5	2012-04-20
0.0.18	11 / 5	2012-04-20
0.0.17	11 / 5	2012-04-20
0.0.16	11 / 5	2012-04-20
0.0.15	11 / 5	2012-04-20
0.0.14	10 / 5	2012-04-15
0.0.13	10 / 5	2012-04-15
0.0.12	10 / 5	2012-04-15
0.0.11	10 / 5	2012-04-15
0.0.10	10 / 5	2012-04-15
0.0.9	10 / 5	2012-04-12
0.0.8	10 / 5	2012-04-12
0.0.7	10 / 5	2012-04-11
0.0.6	10 / 5	2012-03-30
0.0.5	10 / 0	2012-03-30
0.0.4	8 / 0	2012-02-08
0.0.3	8 / 0	2012-02-06