← Home

@across-protocol/sdk

npm Repository Homepage

Across is a system that quickly moves tokens across chains. This repository contains shareable code and libraries for Across.

37
Versions
AGPL-3.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

chrismareemrice32nicholaspaievaldofelipe

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:dist/esm/src/utils/Multicall.js AI (source-diff): Same Multicall3 deployment calldata as CJS build; benign. ai
source-diff encoded-string-file:dist/cjs/src/utils/Multicall.js AI (source-diff): Pre-signed Multicall3 deployment calldata, a known deterministic-deploy pattern, not a payload. ai
phantom-deps phantom-dep:@types/node AI (phantom-deps): Standard types package, loaded by convention. ai
source-diff large-new-source-files AI (source-diff): New files are typechain-generated ABI bindings (Tron_SpokePool); consistent with SDK's pattern of adding chain support. ai
dependencies unvetted-dep:@eth-optimism/sdk AI (dependencies): Official Optimism SDK; expected dependency for a cross-chain bridge protocol. ai
dependencies unvetted-dep:@pinata/sdk AI (dependencies): IPFS pinning SDK; expected utility dependency for a DeFi protocol. ai
dependencies unvetted-dep:@across-protocol/across-token AI (dependencies): First-party dependency from the same org; expected in this SDK. ai
dependencies unvetted-dep:@uma/sdk AI (dependencies): Long-standing dependency of this protocol SDK; stable across many versions. ai
source-diff encoded-string-file:dist/cjs/utils/Multicall.js AI (source-diff): Same Multicall3 deployment calldata in compiled CJS output; not a malicious payload. ai
source-diff encoded-string-file:dist/esm/utils/Multicall.js AI (source-diff): Same Multicall3 deployment calldata in compiled ESM output; not a malicious payload. ai
source-diff encoded-string-file:src/utils/Multicall.ts AI (source-diff): Canonical Multicall3 pre-signed deployment transaction hex; well-documented and stable across versions. ai
phantom-deps phantom-dep:@solana-program/token-2022 AI (phantom-deps): Token-2022 referenced in config for SVM support; stable false positive. ai
install-scripts install-script:postinstall AI (install-scripts): Build script for bigint-buffer native binding; consistent with blockchain SDK use across all versions. ai
phantom-deps phantom-dep:@solana/web3.js AI (phantom-deps): Referenced in config files only; stable false positive for this blockchain SDK. ai
phantom-deps phantom-dep:@types/mocha AI (phantom-deps): Framework-scoped type package; stable false positive. ai
phantom-deps phantom-dep:big-number AI (phantom-deps): Referenced in config files only; stable false positive for this package. ai
phantom-deps phantom-dep:node-gyp AI (phantom-deps): node-gyp is a known implicit dependency for native builds; stable false positive for this package. ai
semgrep semgrep:child-process-import AI (semgrep): child_process used only in build-bigint-buffer.js for native compilation; not a runtime concern. ai
publish-pattern dormant-publish AI (publish-pattern): 492 versions published; CI/CD with SLSA provenance; dormancy flag likely a heuristic artifact for this active package. ai
phantom-deps phantom-dep:@uma/contracts-node AI (phantom-deps): Legitimate dependency for UMA protocol contracts; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:winston-transport AI (phantom-deps): Listed as runtime dep in package.json; phantom-dep heuristic false positive. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding of Solana simulation return data; standard SVM interaction pattern. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding of blockchain relay data hashes; standard pattern for this SDK. ai

Versions (showing 37 of 37)

Version Deps Published
4.4.15 24 / 34
4.4.13 24 / 34
4.4.11 24 / 34
4.4.9 24 / 34
4.4.8 24 / 34
4.4.6 24 / 34
4.4.5 24 / 34
4.4.3 24 / 34
4.4.2 24 / 34
4.4.0 24 / 34
4.3.171 24 / 34
4.3.169 24 / 34
4.3.168 24 / 34
4.3.166 24 / 34
4.3.165 24 / 34
4.3.164 24 / 34
4.3.163 24 / 34
4.3.161 24 / 34
4.3.160 24 / 34
4.3.158 24 / 34
4.3.157 24 / 34
4.3.156 24 / 34
4.3.155 24 / 34
4.3.151 24 / 34
4.3.150 24 / 34
4.3.84 27 / 51
4.3.37 26 / 51
4.3.33 26 / 51
4.3.32 26 / 51
4.3.20 26 / 51
4.3.8 26 / 50
4.3.6 26 / 50
4.2.5 26 / 50
4.1.57 24 / 50
4.1.55 24 / 50
4.1.48 24 / 50
4.1.10 19 / 48

v4.4.15

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.4.13

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.4.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.4.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.4.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.4.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.4.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.3.163

3 findings
HIGH Long encoded string in modified file: dist/cjs/src/utils/Multicall.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/esm/src/utils/Multicall.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.3.84

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.