@bitgo-beta/blake2b
Blake2b (64-bit version) in pure JavaScript
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in test.js is standard test vector parsing for a cryptographic hash library, not a malicious payload. | ai |
v3.2.0
2 findingsThis version was published by a different npm account (bitgobot) than the most recent previously approved version (bitgoaaron) on 2022-11-03. It has since remained available on npm for 1358 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.