@ardrive/turbo-sdk
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:starknet | AI (phantom-deps): starknet is a declared runtime dep; phantom-dep fires because it's config-referenced rather than directly imported in source. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI command uses child_process legitimately; stable pattern for this SDK's CLI tooling. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 0.0.0.0 addresses are local test/dev chain config for KYVE, not exfiltration endpoints. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard base64 utility function with no obfuscation; expected in an Arweave data SDK. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 1.41.1 | 18 / 32 | |
| 1.41.0 | 18 / 32 | |
| 1.40.1 | 18 / 32 | |
| 1.39.2 | 19 / 41 | |
| 1.38.2 | 20 / 41 |
v1.41.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.41.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.40.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.39.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.38.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.