← Home

@chromatic-com/cypress

npm Repository Homepage

Chromatic Visual Regression Testing for Cypress

7
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

katiebayesjmhobbstmeasdayndelangenstevenkittermanthafryertevanoffandrewortweinghengeveldpaulelliottcodykaupwinkervsbecksjustin-thurmanmcnuggies

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@chromaui/rrweb-snapshot AI (dependencies): Chromatic's own fork of rrweb-snapshot; consistent with publisher identity and package purpose across all versions. ai
phantom-deps phantom-dep:storybook AI (phantom-deps): storybook is an intentional peer/runtime dep for this Storybook-integrated Cypress tool, not a phantom. ai
phantom-deps phantom-dep:@storybook/csf AI (phantom-deps): Storybook CSF is an intentional dependency for this Chromatic visual testing package. ai
phantom-deps phantom-dep:@storybook/addon-essentials AI (phantom-deps): Storybook addon-essentials is an intentional dependency for this Chromatic visual testing package. ai
typosquat typosquat.levenshtein:express AI (typosquat): Scoped @chromatic-com/cypress package from the legitimate Chromatic org; edit-distance match to 'express' is purely coincidental. ai
bogus-package bogus-package AI (bogus-package): Established Chromatic tooling package; README link dump signal is a false positive for a well-known testing integration. ai

Versions (showing 7 of 7)

Version Deps Published
0.12.4 4 / 7
0.12.2 4 / 7
0.11.8 8 / 5
0.11.6 8 / 5
0.11.5 8 / 5
0.11.3 8 / 5
0.11.2 8 / 4

v0.12.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.