@nocobase/test — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chenosjiannlu

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:mockjs	AI (phantom-deps): Test utility package; mockjs is referenced in test config, not directly imported.	ai	2026/04/27
phantom-deps	phantom-dep:@vitest/coverage-v8	AI (phantom-deps): Test utility package; vitest coverage plugin loaded by convention.	ai	2026/04/27
phantom-deps	phantom-dep:pg-hstore	AI (phantom-deps): Test utility package; pg-hstore is loaded by convention for database testing.	ai	2026/04/27
phantom-deps	phantom-dep:@types/supertest	AI (phantom-deps): Test utility package; framework-scoped type definitions loaded by convention.	ai	2026/04/27
phantom-deps	phantom-dep:vitest-dom	AI (phantom-deps): Test utility package; vitest-dom is loaded by convention, not directly imported.	ai	2026/04/27
phantom-deps	phantom-dep:@vitest/coverage-istanbul	AI (phantom-deps): Test utility package; vitest coverage plugin loaded by convention.	ai	2026/04/27
phantom-deps	phantom-dep:vite	AI (phantom-deps): Test utility package; vite is referenced in config files and test setup, not directly imported.	ai	2026/04/27
phantom-deps	phantom-dep:jsdom	AI (phantom-deps): Test utility package; jsdom is loaded by vitest convention, not directly imported.	ai	2026/04/27
bogus-package	bogus-package	AI (bogus-package): Monorepo sub-package (@nocobase scope); README quality issues are typical for internal packages not maintained as standalone. Not a spam/phishing package.	ai	2026/04/26
dependencies	unvetted-dep:axios-mock-adapter	AI (dependencies): axios-mock-adapter is a well-known axios mocking library; legitimate testing dependency.	ai	2026/04/26
dependencies	unvetted-dep:mockjs	AI (dependencies): mockjs is a well-known mock data generation library; stable legitimate dependency for a testing package.	ai	2026/04/26
dependencies	unvetted-dep:exceljs	AI (dependencies): exceljs is a well-known Excel file library; legitimate dependency for NocoBase test utilities.	ai	2026/04/26
dependencies	unvetted-dep:pg-hstore	AI (dependencies): pg-hstore is a standard PostgreSQL hstore serializer; legitimate DB testing dependency.	ai	2026/04/26
dependencies	unvetted-dep:vitest-dom	AI (dependencies): vitest-dom is a standard vitest DOM matcher library; expected in a testing package.	ai	2026/04/26
dependencies	unvetted-dep:jsdom-worker	AI (dependencies): jsdom-worker adds Web Worker support to jsdom; legitimate testing utility dependency.	ai	2026/04/26
dependencies	unvetted-dep:@types/supertest	AI (dependencies): @types/supertest is a standard TypeScript type package; expected in a testing utility.	ai	2026/04/26
dependencies	unvetted-dep:@vitest/coverage-v8	AI (dependencies): Official vitest coverage provider; expected in a testing framework package.	ai	2026/04/26
dependencies	unvetted-dep:@vitest/coverage-istanbul	AI (dependencies): Official vitest coverage provider; expected in a testing framework package.	ai	2026/04/26
typosquat	typosquat.levenshtein:jest	AI (typosquat): @nocobase/test is a scoped package in the official NocoBase namespace, not a typosquat of jest. Name is semantically appropriate for a test utility.	ai	2026/04/25
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): Raw IP 127.0.0.1 is localhost used for a local test database creator server — completely benign in a testing utility.	ai	2026/04/25
semgrep	semgrep:env-spread	AI (semgrep): process.env spread is used when spawning child processes in test infrastructure — standard pattern for passing environment to subprocesses, not credential exfiltration.	ai	2026/04/25
typosquat	typosquat.levenshtein:vitest	AI (typosquat): @nocobase/test is a scoped package in the official NocoBase namespace, not a typosquat of vitest.	ai	2026/04/25
typosquat	typosquat.levenshtein:next	AI (typosquat): @nocobase/test is a scoped package in the official NocoBase namespace, not a typosquat of next.	ai	2026/04/25

Versions (showing 30 of 30)

Version	Deps	Published
2.0.56	25 / 0	2026-05-21
2.0.55	25 / 0	2026-05-18
2.0.54	25 / 0	2026-05-15
2.0.53	25 / 0	2026-05-14
2.0.52	25 / 0	2026-05-13
2.0.50	25 / 0	2026-05-09
2.0.48	25 / 0	2026-05-04
2.0.47	25 / 0	2026-05-01
2.0.46	25 / 0	2026-04-28
2.0.45	25 / 0	2026-04-27
2.0.44	25 / 0	2026-04-26
2.0.43	25 / 0	2026-04-24
2.0.42	25 / 0	2026-04-23
2.0.39	25 / 0	2026-04-17
2.0.38	25 / 0	2026-04-16
2.0.36	25 / 0	2026-04-10
2.0.35	25 / 0	2026-04-09
2.0.34	25 / 0	2026-04-08
2.0.32	25 / 0	2026-04-04
2.0.27	25 / 0	2026-03-26
2.0.26	25 / 0	2026-03-25
2.0.8	25 / 0	2026-03-01
2.0.7	25 / 0	2026-02-27
2.0.0	25 / 0	2026-02-14
1.9.60	24 / 0	2026-04-09
1.9.59	24 / 0	2026-04-09
1.9.57	24 / 0	2026-04-02
1.9.11	24 / 0	2025-11-21
1.9.5	24 / 0	2025-11-10
1.8.32	24 / 0	2025-10-27

v2.0.56

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.55

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.54

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.53

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.52

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.50

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.48

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.47

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.45

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.44

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.43

3 findings

HIGH typosquat.levenshtein: Possible typosquat of 'jest' typosquat

Package name '@nocobase/test' is 1 edit(s) away from popular package 'jest'.

HIGH env-spread: lib/server/mock-isolated-cluster.js:67 semgrep

Spreading entire process.env into an object — may capture all secrets 65 | const port = await (0, import_portfinder.getPortPromise)(); 66 | const childProcess = (0, import_node_child_process.spawn)("node", ["./node_modules/tsx/dist/cli.mjs", this.script, > 67 | env: { 68 | ...process.env, 69 | ...this.options.env,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.42

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.39

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.38

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.36

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.35

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.34

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.32

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.60

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.59

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.57

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.8.32

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.