@zibby/core
Core test automation engine with multi-agent and multi-MCP support
50
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
zibby
Keywords
testingautomationplaywrightaimcp
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:handlebars | AI (dependencies): Well-known, widely used templating library; no malicious behavior indicated. | ai | |
| phantom-deps | phantom-dep:@zibby/skill-ids | AI (phantom-deps): Same-org scoped sibling package, consistent with other accepted phantom deps. | ai | |
| dependencies | unvetted-dep:@zibby/skill-ids | AI (dependencies): Same-org package under trusted publisher's established scope. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Package has 73 versions with frequent iteration; rapid publishes are consistent with active development cadence. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Declared in dependencies; likely used in bundled dist output or config files. | ai | |
| source-diff | obfuscated-file:dist/models.js | AI (source-diff): File contains minified but fully readable AI model alias data; not obfuscated malicious code. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Declared in dependencies; likely used in bundled dist output or config files. | ai | |
| phantom-deps | phantom-dep:handlebars | AI (phantom-deps): Declared in dependencies; likely used in bundled dist output or config files. | ai | |
| phantom-deps | phantom-dep:@openai/codex-sdk | AI (phantom-deps): Listed as runtime dep in package.json; phantom-dep heuristic fires because it's config-referenced, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:zod-to-json-schema | AI (phantom-deps): Listed as runtime dep; phantom-dep heuristic fires on config reference pattern, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid is a declared dep bundled into dist; phantom-dep heuristic fires on bundled packages. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used in graph-compiler to evaluate user-defined workflow node code; expected pattern for this framework. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes Playwright frame-snapshot HTML from trace events; not a payload obfuscation pattern. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New AI strategy modules added; expected growth for this package's feature set. | ai | |
| source-diff | obfuscated-file:dist/strategies/index.js | AI (source-diff): Standard esbuild minified output; strategy barrel file. | ai | |
| source-diff | obfuscated-file:dist/strategies/assistant-strategy.js | AI (source-diff): Standard esbuild minified output; readable AI strategy logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/strategies/claude-strategy.js | AI (source-diff): Standard esbuild minified output; readable Claude strategy logic. | ai | |
| source-diff | obfuscated-file:dist/strategies/codex-strategy.js | AI (source-diff): Standard esbuild minified output; readable Codex strategy logic. | ai | |
| source-diff | obfuscated-file:dist/strategies/cursor-strategy.js | AI (source-diff): Standard esbuild minified output; readable Cursor strategy logic. | ai | |
| source-diff | obfuscated-file:dist/strategies/gemini-strategy.js | AI (source-diff): Standard esbuild minified output; readable Gemini strategy logic. | ai | |
| source-diff | obfuscated-file:dist/skills/session/index.js | AI (source-diff): Standard esbuild minified output; UUID and session store logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/strategies/utils/openai-proxy-formatter.js | AI (source-diff): Standard esbuild minified output; reads auth tokens from env/config, expected for this tool. | ai | |
| source-diff | obfuscated-file:dist/register-built-in-strategies.js | AI (source-diff): Standard esbuild minified output; strategy registration file. | ai | |
| source-diff | obfuscated-file:dist/skills/session/session-skill.js | AI (source-diff): Standard esbuild minified output; session skill logic. | ai | |
| phantom-deps | phantom-dep:@zibby/workflow | AI (phantom-deps): Same-org scope dep; likely re-exported or used transitively by templates. | ai | |
| phantom-deps | phantom-dep:@anthropic-ai/claude-agent-sdk | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/sdk | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:@zibby/mcp-browser | AI (phantom-deps): Same-org scoped dep; phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:@anthropic-ai/sdk | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:@playwright/mcp | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:acorn-walk | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:acorn | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| phantom-deps | phantom-dep:hono | AI (phantom-deps): Declared dep used in config/templates, phantom-dep heuristic fires on indirect usage patterns. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped package @zibby/core is a test automation engine, not a typosquat of cors; name collision is coincidental. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread in git clone template is standard child-process env passing, not exfiltration. | ai |
Versions (showing 50 of 50)
| Version | Deps | Published |
|---|---|---|
| 0.5.28 | 17 / 3 | |
| 0.5.27 | 17 / 3 | |
| 0.5.26 | 17 / 3 | |
| 0.5.25 | 17 / 3 | |
| 0.5.24 | 16 / 3 | |
| 0.5.23 | 16 / 3 | |
| 0.5.22 | 17 / 3 | |
| 0.5.16 | 17 / 3 | |
| 0.5.12 | 17 / 3 | |
| 0.5.6 | 17 / 3 | |
| 0.5.4 | 17 / 3 | |
| 0.5.3 | 17 / 3 | |
| 0.5.0 | 17 / 3 | |
| 0.4.5 | 17 / 3 | |
| 0.4.4 | 17 / 3 | |
| 0.4.0 | 16 / 3 | |
| 0.3.12 | 16 / 3 | |
| 0.3.10 | 16 / 3 | |
| 0.3.9 | 16 / 3 | |
| 0.3.8 | 16 / 3 | |
| 0.3.6 | 16 / 3 | |
| 0.3.5 | 16 / 3 | |
| 0.3.3 | 16 / 3 | |
| 0.3.2 | 16 / 3 | |
| 0.3.0 | 16 / 3 | |
| 0.2.0 | 16 / 3 | |
| 0.1.46 | 16 / 3 | |
| 0.1.45 | 16 / 3 | |
| 0.1.42 | 16 / 3 | |
| 0.1.41 | 15 / 3 | |
| 0.1.40 | 15 / 3 | |
| 0.1.38 | 15 / 3 | |
| 0.1.37 | 15 / 3 | |
| 0.1.36 | 15 / 3 | |
| 0.1.33 | 15 / 3 | |
| 0.1.30 | 15 / 3 | |
| 0.1.29 | 14 / 3 | |
| 0.1.27 | 14 / 3 | |
| 0.1.25 | 14 / 3 | |
| 0.1.21 | 13 / 2 | |
| 0.1.20 | 13 / 2 | |
| 0.1.15 | 13 / 2 | |
| 0.1.13 | 13 / 2 | |
| 0.1.10 | 13 / 2 | |
| 0.1.9 | 13 / 2 | |
| 0.1.8 | 13 / 2 | |
| 0.1.6 | 12 / 2 | |
| 0.1.5 | 12 / 2 | |
| 0.1.1 | 12 / 2 | |
| 0.1.0 | 12 / 2 |
v0.5.28
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.27
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.26
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.25
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.24
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.23
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.22
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.20
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.15
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.13
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.