@friggframework/test

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
typosquat	typosquat.levenshtein:jest	AI (typosquat): Scoped monorepo package @friggframework/test; not impersonating jest.	ai	2026/04/29
typosquat	typosquat.levenshtein:next	AI (typosquat): Scoped monorepo package; no relation to next.js.	ai	2026/04/29
typosquat	typosquat.levenshtein:vitest	AI (typosquat): Scoped monorepo package; no relation to vitest.	ai	2026/04/29
semgrep	semgrep:env-spread	AI (semgrep): overrideEnvironment is a test utility for injecting env vars; not exfiltration.	ai	2026/04/29
phantom-deps	phantom-dep:eslint	AI (phantom-deps): ESLint plugins/configs are loaded by config convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-json	AI (phantom-deps): ESLint plugin loaded by config, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-yaml	AI (phantom-deps): ESLint plugin loaded by config, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:jest-runner-groups	AI (phantom-deps): Jest runner loaded by jest config convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:@babel/eslint-parser	AI (phantom-deps): Babel ESLint parser loaded by config convention.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-config-prettier	AI (phantom-deps): ESLint config loaded by convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-markdown	AI (phantom-deps): ESLint plugin loaded by config, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-no-only-tests	AI (phantom-deps): ESLint plugin loaded by config, not direct import.	ai	2026/04/29

Version	Deps	Published
1.2.2	10 / 4	2024-08-09