← Home

@pact-foundation/pact

npm Repository Homepage

Pact for all things Javascript

9
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mefellows-pactyou54fmfellowsmefellowstimothyjones

Keywords

pactpact-jsjavascriptcontract testingtestingconsumer driven testing

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Occurs in a test spec file to snapshot/restore process.env in afterEach — standard test hygiene, not a secret leak. ai
dependencies unvetted-dep:http-proxy AI (dependencies): http-proxy is a core dependency for pact-js's verifier proxy functionality; stable and expected for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes HTTP request body content for message pact verification — legitimate protocol handling. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IP is 127.0.0.1 (localhost) used as default proxy base URL — expected for a local proxy in contract testing. ai
typosquat typosquat.levenshtein:react AI (typosquat): Scoped package @pact-foundation/pact is not a typosquat of react; completely different domain and well-established org. ai
phantom-deps phantom-dep:router AI (phantom-deps): router is a declared runtime dependency in package.json; phantom-dep heuristic false positive. ai

Versions (showing 9 of 9)

Version Deps Published
17.0.0 16 / 20
16.5.0 15 / 20
16.4.0 15 / 31
16.3.1 15 / 41
16.1.0 15 / 41
16.0.4 15 / 41
16.0.3 15 / 41
16.0.1 14 / 40
16.0.0 14 / 40

v17.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.