@aztec/world-state
27
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
zac-williamsonleilawangcharlielyejaosefjoss-aztecprotocolludamad
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @aztec/bb.js is in-org sibling at matching version; msgpackr is a well-known serialization lib. | ai | |
| phantom-deps | phantom-dep:@aztec/kv-store | AI (phantom-deps): In-org sibling package, likely used indirectly via monorepo build. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): zod is declared as a runtime dependency in package.json; phantom-dep finding is a packaging style issue, not a security risk for this package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit TypeScript runtime dependency; its presence as a declared-but-indirectly-imported dep is standard for TS monorepos. | ai | |
| provenance | no-provenance | AI (provenance): Aztec monorepo packages consistently lack Sigstore provenance; this is a stable characteristic of the package family, not a per-version anomaly. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 5.0.0 | 11 / 9 | |
| 4.4.0 | 10 / 9 | |
| 4.3.1 | 10 / 9 | |
| 4.3.0 | 10 / 9 | |
| 4.2.1 | 10 / 9 | |
| 4.2.0 | 10 / 9 | |
| 4.1.3 | 10 / 9 | |
| 4.1.2 | 10 / 9 | |
| 4.1.1 | 10 / 9 | |
| 4.1.0 | 10 / 9 | |
| 4.0.4 | 10 / 9 | |
| 4.0.3 | 10 / 9 | |
| 4.0.2 | 10 / 9 | |
| 4.0.1 | 10 / 9 | |
| 3.0.3 | 10 / 9 | |
| 3.0.2 | 10 / 9 | |
| 3.0.1 | 10 / 9 | |
| 2.1.11 | 10 / 8 | |
| 2.1.9 | 10 / 8 | |
| 2.1.8 | 10 / 8 | |
| 2.1.7 | 10 / 8 | |
| 2.1.6 | 10 / 8 | |
| 2.1.5 | 10 / 8 | |
| 2.1.4 | 10 / 8 | |
| 2.1.3 | 10 / 8 | |
| 2.1.2 | 10 / 8 | |
| 2.0.4 | 10 / 8 |
v5.0.0
2 findings
HIGH
Missing gitHead — previous versions had it
provenance
This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: charlielye.
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.