@replayio/cypress
17
Versions
—
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
andaristbhackett1024replayio-release-botacemarke
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): New source files correspond to bundled @replayio/test-utils code, consistent with the dep restructuring from runtime to devDep with internal bundling. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by bundling @replayio/test-utils internally (previously an external runtime dep); bundled files are visible in dist/_bundled/ path. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (winston, mixpanel, launchdarkly, etc.) are established packages consistent with telemetry/logging features in a test recording tool from the verified replayio org. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs a local bundled first-run.js via Node — standard setup pattern for Replay's developer tooling. No network calls or obfuscation; stable across versions. | ai | |
| phantom-deps | phantom-dep:p-map | AI (phantom-deps): p-map is properly declared in dependencies and used in the package; phantom-dep rule is a false positive for this monorepo/build-tool context. | ai | |
| phantom-deps | phantom-dep:is-uuid | AI (phantom-deps): is-uuid is properly declared in dependencies; phantom-dep rule is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:terminate | AI (phantom-deps): terminate is properly declared in dependencies; phantom-dep rule is a false positive for this package. | ai | |
| dependencies | unvetted-dep:mixpanel | AI (dependencies): mixpanel is a standard analytics SDK; expected in a developer tooling product for usage tracking. | ai | |
| dependencies | unvetted-dep:terminate | AI (dependencies): terminate is a process management utility; appropriate for a test runner plugin managing child processes. | ai | |
| dependencies | unvetted-dep:winston-loki | AI (dependencies): winston-loki is a log transport for Grafana Loki; expected in a test recording/observability tool. | ai | |
| dependencies | unvetted-dep:is-uuid | AI (dependencies): is-uuid is a simple UUID validation library; no security concerns for this package. | ai | |
| dependencies | unvetted-dep:sha-1 | AI (dependencies): sha-1 is a standard hashing utility appropriate for this package's use case. | ai | |
| dependencies | unvetted-dep:txml | AI (dependencies): txml is a legitimate XML parsing library used in this test recording plugin; no security concerns. | ai | |
| typosquat | typosquat.levenshtein:express | AI (typosquat): @replayio/cypress is a scoped package named after the Cypress testing framework, not a typosquat of express. Levenshtein match is a false positive. | ai |