← Home

@arbitrum/nitro-contracts

npm Repository Homepage
3
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

dzgoldmanhkalodnerspsjvcgzeon

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): Offchain Labs restructured this package significantly (removed many scripts/deps); dormancy reflects a legitimate major refactor, not account takeover. ai
phantom-deps phantom-dep:solady AI (phantom-deps): Solady is a Solidity library referenced in Foundry/Hardhat config, not imported as a JS module. Normal pattern for smart contract packages. ai
phantom-deps phantom-dep:patch-package AI (phantom-deps): patch-package is used via postinstall script, not directly imported. Expected pattern. ai
install-scripts install-script:postinstall AI (install-scripts): postinstall runs `patch-package`, a standard tool for patching node_modules in Solidity/Hardhat projects. No network calls or arbitrary code execution. Stable pattern for this package. ai
phantom-deps phantom-dep:@offchainlabs/upgrade-executor AI (phantom-deps): Solidity library referenced in build config, not a JS import. Normal pattern for this type of package. ai
phantom-deps phantom-dep:@openzeppelin/contracts-upgradeable AI (phantom-deps): Solidity library referenced in build config, not a JS import. Normal pattern for smart contract packages. ai
phantom-deps phantom-dep:@openzeppelin/contracts AI (phantom-deps): OpenZeppelin contracts are Solidity libraries referenced in build config, not JS imports. Normal for smart contract packages. ai

Versions (showing 3 of 3)

Version Deps Published
3.2.0 5 / 39
3.1.1 5 / 39
3.0.0 5 / 39

v3.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: patch-package

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.