js-logger
Lightweight, unobtrusive, configurable JavaScript logger
18
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
calanizjonnyreeves
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:test-src/vendor/sinon-1.10.3.js | AI (source-diff): This is the well-known Sinon.JS 1.10.3 test mocking library vendored under test-src/vendor/. XHR faking and dynamic function wrapping are core Sinon features, not malware. False positive for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change (calaniz → jonnyreeves) occurred in 2014 and reflects a legitimate account transition; jonnyreeves is the documented author with matching GitHub repo and strong track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): jonnyreeves is the documented author of js-logger; maintainer addition reflects legitimate ownership, not a takeover. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is fully explained by addition of qunit-1.14.0.js (61KB) in the test vendor directory — a known testing library, not a payload. | ai | |
| source-diff | net-exec-file:test-src/vendor/sinon-1.14.1.js | AI (source-diff): Sinon.JS 1.14.1 vendored into test-src/vendor/ is a well-known BSD-licensed test mocking library. Network/exec patterns are its XHR-faking and spy features, not malware. Not a runtime dependency. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process.spawn in gulpfile.js is standard build tooling usage, not runtime code. Stable false positive for this package. | ai |