← Home

@aptos-labs/ts-sdk

npm Homepage
15
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aptos-labsgregnazario

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:base64-decode AI (semgrep): Standard idiomatic base64 decoding in a cryptographic blockchain SDK utility function. No malicious payload hiding; this pattern is expected and stable for this package. ai
semgrep semgrep:env-spread AI (semgrep): process.env spread is used to pass environment to a local node child process in CLI tooling — standard pattern, no exfiltration risk. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): All raw IPs are 127.0.0.1 (localhost) used for local Aptos node development tooling — not C2 or exfiltration. ai
semgrep semgrep:shady-links-tlds AI (semgrep): shelbynet.shelby.xyz is a legitimate Aptos ecosystem test network faucet endpoint, not a C2 domain. ai
typosquat typosquat.levenshtein:aws-sdk AI (typosquat): False positive — @aptos-labs/ts-sdk is the official Aptos TypeScript SDK, unrelated to aws-sdk. Scoped package with clear org identity. ai
phantom-deps phantom-dep:@aptos-labs/aptos-cli AI (phantom-deps): First-party Aptos Labs CLI tool dependency used as a runtime tool, not a code import. Expected pattern for this SDK. ai

Versions (showing 15 of 15)

Version Deps Published
7.1.0 10 / 18
7.0.1 10 / 18
7.0.0 10 / 18
6.3.1 10 / 19
6.3.0 10 / 19
6.2.0 10 / 19
6.1.0 10 / 26
6.0.0 10 / 32
5.2.1 10 / 32
5.2.0 10 / 32
5.1.6 10 / 32
5.1.5 10 / 32
5.1.4 10 / 32
5.1.3 10 / 32
5.1.2 10 / 32

v7.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.0

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: gregnazario.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.1

2 findings
HIGH env-spread: src/cli/localNode.ts:102 semgrep

Spreading entire process.env into an object — may capture all secrets 100 | const currentPlatform = platform(); 101 | const spawnConfig = { > 102 | env: { ...process.env, ENABLE_KEYLESS_DEFAULT: "1" }, 103 | ...(currentPlatform === "win32" && { shell: true }), 104 | };

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.