@cucumber/cucumber
The official JavaScript implementation of Cucumber.
17
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
cukebot
Keywords
testingbddcucumbergherkintests
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/runtime/executor.js | AI (source-diff): Readable compiled TS, long lines are build output not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/runtime/parallel/test_cases_phase.js | AI (source-diff): TypeScript compiled output with readable class definitions; not obfuscated. | ai | |
| npm-metadata | url-dep:@cucumber/biome-config | AI (npm-metadata): DevDependency from same cucumber org; not shipped at runtime. | ai | |
| source-diff | obfuscated-file:lib/runtime/parallel/worker.mjs | AI (source-diff): TypeScript compiled output with readable imports and logic; not obfuscated. | ai | |
| dependencies | unvetted-dep:knuth-shuffle-seeded | AI (dependencies): Legitimate dependency of established cucumber-js package. | ai | |
| dependencies | unvetted-dep:@cucumber/gherkin-utils | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/ci-environment | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/html-formatter | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/message-streams | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/tag-expressions | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:assertion-error-formatter | AI (dependencies): Legitimate dependency of established cucumber-js package. | ai | |
| dependencies | unvetted-dep:@cucumber/pretty-formatter | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/junit-xml-formatter | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/cucumber-expressions | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/gherkin-streams | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:figures | AI (dependencies): Legitimate dependency of established cucumber-js package. | ai | |
| dependencies | unvetted-dep:@cucumber/gherkin | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/messages | AI (dependencies): First-party @cucumber org dependency. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Config file loader pattern — loads user-specified .js/.cjs config files by path, not arbitrary attacker-controlled input. | ai | |
| phantom-deps | phantom-dep:@cucumber/junit-xml-formatter | AI (phantom-deps): Same-org formatter dependency; declared as runtime dep for optional use, stable false positive. | ai | |
| phantom-deps | phantom-dep:@cucumber/pretty-formatter | AI (phantom-deps): Same-org formatter dependency; declared as runtime dep for optional use, stable false positive. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used in a Proxy handler for scope management, not for obfuscation or evasion. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 13.2.0 | 32 / 43 | |
| 13.1.1 | 32 / 43 | |
| 13.1.0 | 32 / 43 | |
| 13.0.0 | 34 / 43 | |
| 12.9.0 | 39 / 54 | |
| 12.8.3 | 39 / 54 | |
| 12.8.2 | 39 / 54 | |
| 12.8.1 | 39 / 54 | |
| 12.8.0 | 39 / 54 | |
| 12.7.0 | 40 / 54 | |
| 12.6.0 | 40 / 54 | |
| 12.5.0 | 40 / 54 | |
| 12.4.0 | 40 / 54 | |
| 12.3.0 | 40 / 54 | |
| 12.2.0 | 40 / 54 | |
| 12.1.0 | 39 / 56 | |
| 12.0.0 | 39 / 55 |
v13.2.0
2 findings
HIGH
New obfuscated file: lib/runtime/executor.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v13.1.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v13.1.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.