@open-xchange/appsuite-codeceptjs AGPL-3.0-or-later 35 versions

@open-xchange/appsuite-codeceptjs

npm Repository

OX App Suite CodeceptJS Configuration and Helpers

35

Versions

AGPL-3.0-or-later

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

johnybdavidbauersolygendaniel.rentzalexquastd.hausmaik.schaeferandreebjoern.koestermbiggeleben

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): New dep is same-org scoped package (@open-xchange/appsuite-codeceptjs-pageobjects); low risk.	ai	2026/06/04
maintainer-change	maintainer-added	AI (maintainer-change): mbiggeleben added within same org; consistent with internal team management.	ai	2026/06/04
dependencies	unvetted-dep:chalk-table	AI (dependencies): chalk-table is a simple table-formatting utility; stable dependency in this package's context.	ai	2026/06/04
phantom-deps	phantom-dep:playwright-core	AI (phantom-deps): Playwright peer dep referenced in config, not directly imported — expected pattern.	ai	2026/05/31
semgrep	semgrep:env-spread	AI (semgrep): CLI runner intentionally forwards parent env to child process; standard pattern for test tooling.	ai	2026/05/30
dependencies	unvetted-dep:@types/chai	AI (dependencies): @types/chai is a TypeScript type declaration package with no runtime execution risk.	ai	2026/05/29
phantom-deps	phantom-dep:@types/mocha	AI (phantom-deps): Type-only package loaded by framework convention, not directly imported.	ai	2026/05/27
phantom-deps	phantom-dep:@types/chai	AI (phantom-deps): Type-only package loaded by framework convention, not directly imported.	ai	2026/05/27
phantom-deps	phantom-dep:mocha	AI (phantom-deps): Referenced in config files only; normal for a test framework wrapper package.	ai	2026/05/27
phantom-deps	phantom-dep:@open-xchange/codecept-horizontal-scaler	AI (phantom-deps): Same org scope; declared dep used indirectly via config, not a phantom risk.	ai	2026/05/27
phantom-deps	phantom-dep:@open-xchange/codeceptjs-hindsight	AI (phantom-deps): Same org scope; declared dep used indirectly via config, not a phantom risk.	ai	2026/05/27
phantom-deps	phantom-dep:mocha-junit-reporter	AI (phantom-deps): Referenced in config files only; normal for a test framework wrapper package.	ai	2026/05/27
phantom-deps	phantom-dep:allure-codeceptjs	AI (phantom-deps): Referenced in config files only; normal for a test framework wrapper package.	ai	2026/05/27
phantom-deps	phantom-dep:mocha-multi	AI (phantom-deps): Referenced in config files only; normal for a test framework wrapper package.	ai	2026/05/27

Versions (showing 35 of 35)

Version	Deps	Published
0.13.3	20 / 4	2026-06-03
0.13.2	20 / 4	2026-06-01
0.13.1	20 / 4	2026-05-28
0.13.0	20 / 4	2026-05-28
0.12.0	20 / 4	2026-05-28
0.11.0	18 / 4	2026-05-27
0.10.0	18 / 4	2026-05-26
0.9.8	20 / 5	2026-05-21
0.9.6	20 / 4	2026-05-12
0.9.4	20 / 4	2026-04-28
0.9.2	20 / 4	2026-04-07
0.9.1	20 / 4	2026-04-07
0.9.0	18 / 4	2026-04-06
0.8.1	18 / 4	2026-03-26
0.8.0	18 / 4	2026-03-16
0.7.2	21 / 4	2026-03-09
0.7.1	21 / 4	2026-02-26
0.7.0	21 / 4	2026-02-24
0.6.20	21 / 4	2026-02-24
0.6.19	21 / 4	2026-02-24
0.6.18	21 / 4	2026-02-23
0.6.17	21 / 4	2026-02-13
0.6.16	21 / 4	2026-01-22
0.6.15	21 / 4	2025-12-12
0.6.14	21 / 4	2025-12-12
0.6.13	21 / 4	2025-09-30
0.6.12	21 / 4	2025-09-25
0.6.11	20 / 4	2025-09-24
0.6.10	20 / 4	2025-09-15
0.6.9	20 / 4	2025-09-12
0.6.8	20 / 4	2025-08-25
0.6.7	20 / 4	2025-07-18
0.6.6	20 / 4	2025-07-18
0.6.4	20 / 4	2025-06-13
0.6.3	20 / 4	2025-06-11

v0.13.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.1

2 findings

HIGH env-spread: customRerun.js:30 semgrep

Spreading entire process.env into an object — may capture all secrets 28 | const args = ['run', '--override', JSON.stringify({ plugins: { junitReporter: { outputName: junitName } } })] 29 | if (grep) args.push('--grep', grep) > 30 | const child = spawn(bin, args, { stdio: 'inherit', env: { ...process.env, ...extraEnv } }) 31 | child.on('exit', code => resolve(code ?? 1)) 32 | child.on('error', () => resolve(1))

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

2 findings

HIGH env-spread: customRerun.js:30 semgrep

Spreading entire process.env into an object — may capture all secrets 28 | const args = ['run', '--override', JSON.stringify({ plugins: { junitReporter: { outputName: junitName } } })] 29 | if (grep) args.push('--grep', grep) > 30 | const child = spawn(bin, args, { stdio: 'inherit', env: { ...process.env, ...extraEnv } }) 31 | child.on('exit', code => resolve(code ?? 1)) 32 | child.on('error', () => resolve(1))

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

2 findings

HIGH env-spread: customRerun.js:30 semgrep

Spreading entire process.env into an object — may capture all secrets 28 | const args = ['run', '--override', JSON.stringify({ plugins: { junitReporter: { outputName: junitName } } })] 29 | if (grep) args.push('--grep', grep) > 30 | const child = spawn(bin, args, { stdio: 'inherit', env: { ...process.env, ...extraEnv } }) 31 | child.on('exit', code => resolve(code ?? 1)) 32 | child.on('error', () => resolve(1))

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

2 findings

HIGH env-spread: customRerun.js:30 semgrep

Spreading entire process.env into an object — may capture all secrets 28 | const args = ['run', '--override', JSON.stringify({ plugins: { junitReporter: { outputName: junitName } } })] 29 | if (grep) args.push('--grep', grep) > 30 | const child = spawn(bin, args, { stdio: 'inherit', env: { ...process.env, ...extraEnv } }) 31 | child.on('exit', code => resolve(code ?? 1)) 32 | child.on('error', () => resolve(1))

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: johnyb → maik.schaefer (on 2026-04-07, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (johnyb) on 2026-04-07, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.9.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: johnyb → maik.schaefer (on 2026-04-07, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (johnyb) on 2026-04-07, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: davidbauer → maik.schaefer (on 2026-03-26, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (davidbauer) on 2026-03-26, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: davidbauer → maik.schaefer (on 2026-03-09, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (davidbauer) on 2026-03-09, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: davidbauer → maik.schaefer (on 2026-02-26, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (davidbauer) on 2026-02-26, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.16

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: johnyb → maik.schaefer (on 2026-01-22, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (johnyb) on 2026-01-22, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.15

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: andree → davidbauer (on 2025-12-12, known maintainer) provenance

This version was published by a different npm account (davidbauer) than the most recent previously approved version (andree) on 2025-12-12, but davidbauer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.14

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: andree → davidbauer (on 2025-12-12, known maintainer) provenance

This version was published by a different npm account (davidbauer) than the most recent previously approved version (andree) on 2025-12-12, but davidbauer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.13

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: johnyb → andree (on 2025-09-30, known maintainer) provenance

This version was published by a different npm account (andree) than the most recent previously approved version (johnyb) on 2025-09-30, but andree is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.12

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: johnyb → maik.schaefer (on 2025-09-25, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (johnyb) on 2025-09-25, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.9

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: johnyb → maik.schaefer (on 2025-09-12, known maintainer) provenance

This version was published by a different npm account (maik.schaefer) than the most recent previously approved version (johnyb) on 2025-09-12, but maik.schaefer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.