@replayio/test-utils
12
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
replayio-release-botandaristbrianvaughnacemarkebhackett1024dmiller_replayholger_replayjcmorrowjasonlaster11
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (undici, winston, fs-extra, winston-loki) are all well-established, legitimate packages consistent with test recording/logging functionality for Replay.io. | ai | |
| provenance | publisher-changed | AI (provenance): andarist is a highly established npm publisher (3286 days, 2082 approved packages) taking over from ryanjduffy on the replayio org — consistent with a legitimate maintainer transition. | ai | |
| dependencies | unvetted-dep:winston-loki | AI (dependencies): winston-loki is a standard Loki logging transport for winston; legitimate use in a logging-capable test utility package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard JWT/auth token payload decoding pattern in auth.ts; not a malicious payload — it's parsing a base64-encoded token passed as input. | ai | |
| dependencies | unvetted-dep:launchdarkly-node-client-sdk | AI (dependencies): LaunchDarkly's official Node.js SDK; legitimate use for feature flagging in Replay.io's test utilities. | ai | |
| dependencies | unvetted-dep:query-registry | AI (dependencies): query-registry is a legitimate npm registry query library; appropriate for a test-utils package that checks package versions. | ai | |
| dependencies | unvetted-dep:mixpanel | AI (dependencies): Mixpanel is a well-known analytics SDK; its use in a test-utils package for telemetry is legitimate and expected. | ai |