@aztec/end-to-end
This package includes end-to-end tests that cover Aztec's main milestones. These can be run locally either by starting anvil on a different terminal.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are same-org first-party siblings, not third-party additions. | ai | |
| source-diff | obfuscated-file:dest/spartan/utils/k8s.d.ts | AI (source-diff): TypeScript .d.ts declaration file, not obfuscated code. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Monorepo package with coordinated multi-package releases; new spartan/k8s test utils are expected. | ai | |
| source-diff | obfuscated-file:dest/spartan/utils/chaos.d.ts | AI (source-diff): TypeScript .d.ts declaration file with long JSDoc comments, not obfuscated code. | ai | |
| dependencies | unvetted-dep:@aztec/noir-protocol-circuits-types | AI (dependencies): First-party Aztec workspace package, pinned to same version. | ai | |
| phantom-deps | phantom-dep:@aztec/bot | AI (phantom-deps): Same-org workspace dep used via config, not direct import. | ai | |
| source-diff | obfuscated-file:dest/single-node/cross-chain/cross_chain_messaging_test.d.ts | AI (source-diff): TS .d.ts file with long JSDoc comment lines, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dest/automine/automine_test_context.d.ts | AI (source-diff): TS .d.ts file with long JSDoc comment lines, not obfuscated code. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Config/tooling usage, monorepo pattern. | ai | |
| source-diff | obfuscated-file:dest/single-node/fees/fees_test.d.ts | AI (source-diff): TS .d.ts file with long JSDoc comment lines, not obfuscated code. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency for TypeScript compiled output. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): End-to-end test package; pg is used in config/test infrastructure, not directly imported in source. Expected for this package type. | ai | |
| phantom-deps | phantom-dep:koa | AI (phantom-deps): Used in test server config files, not directly imported. Expected for e2e test harness. | ai | |
| phantom-deps | phantom-dep:jest | AI (phantom-deps): Jest is the test runner; referenced in config files. Standard phantom-dep pattern for test packages. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): TypeScript referenced in build/config files. Standard for compiled packages. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in test fixtures uses well-known Hardhat/Anvil test private keys (ac0974bec...). Standard test fixture code, not malicious payload hiding. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): execSync in legacy-jest-resolver.cjs for resolving contract artifact versions during test runs. Standard build/test tooling usage. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() used in a proxy pattern for test wallet utility — legitimate JavaScript Proxy handler, not obfuscation. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): process.env spread in subprocess helper for test infrastructure to pass environment variables to child processes. Standard test tooling pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding of Kubernetes secrets (POSTGRES_USER/PASSWORD) in test infrastructure. Standard k8s secret handling pattern. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): All raw IP references are 127.0.0.1 (localhost) for local telemetry/metrics collection in test environments. Benign test infrastructure pattern. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 5.0.0 | 77 / 13 | |
| 4.3.1 | 78 / 13 | |
| 4.3.0 | 78 / 13 | |
| 4.2.1 | 78 / 13 | |
| 4.2.0 | 78 / 13 | |
| 4.1.3 | 78 / 13 | |
| 4.1.2 | 78 / 13 | |
| 4.1.0 | 78 / 13 | |
| 3.0.1 | 75 / 12 | |
| 2.1.6 | 73 / 11 | |
| 2.1.4 | 73 / 11 | |
| 2.1.3 | 73 / 11 | |
| 2.0.4 | 73 / 11 |
v5.0.0
5 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: charlielye.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.