@aztec/wallet-sdk
This guide explains how to integrate your wallet with the Aztec Wallet SDK, enabling dApps to discover and interact with your wallet implementation.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dest/extension/handlers/background_connection_handler.d.ts | AI (source-diff): File is a TypeScript declaration (.d.ts) with readable, well-commented type definitions for a wallet extension SDK. Long lines are from complex type signatures, not obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump (v3→v4) for an established Aztec Protocol SDK adding browser extension wallet infrastructure. Size increase is expected and consistent with new exported entry points. | ai | |
| source-diff | source-size-tripled | AI (source-diff): 3.8x size increase reflects legitimate major version feature additions (extension handlers, provider, manager modules) in a well-established ZK wallet SDK. | ai | |
| dependencies | unvetted-dep:@aztec/pxe | AI (dependencies): @aztec/pxe is a sibling package from the same Aztec Protocol monorepo, always released in lockstep with @aztec/wallet-sdk. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:@aztec/aztec.js | AI (dependencies): @aztec/aztec.js is the core Aztec Protocol SDK, a sibling package from the same monorepo released in lockstep. Not a third-party risk. | ai | |
| provenance | no-provenance | AI (provenance): Aztec monorepo packages consistently lack Sigstore provenance; this is a stable characteristic of the @aztec/* namespace, not a per-version anomaly. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 4.3.1 | 6 / 12 | |
| 4.3.0 | 6 / 12 | |
| 4.2.1 | 6 / 12 | |
| 4.2.0 | 6 / 12 | |
| 4.1.3 | 6 / 12 | |
| 4.1.2 | 6 / 12 | |
| 4.1.1 | 6 / 12 | |
| 4.1.0 | 6 / 12 | |
| 4.0.4 | 6 / 12 | |
| 4.0.3 | 6 / 12 | |
| 4.0.2 | 6 / 12 | |
| 4.0.1 | 6 / 12 | |
| 3.0.3 | 6 / 12 | |
| 3.0.2 | 6 / 12 | |
| 3.0.1 | 6 / 12 |
v4.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.