@bitgo-beta/sdk-coin-algo
BitGo SDK coin library for Algorand
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): bitgoaaron → bitgobot is a legitimate BitGo org transition to automated publishing. | ai | |
| source-diff | obfuscated-file:dist/test/integration/algo.integration.js | AI (source-diff): Compiled TypeScript test file; long lines from inline test data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/test/fixtures/algo.js | AI (source-diff): Test fixture data file; long lines are serialized test wallet/transaction data. | ai | |
| source-diff | obfuscated-file:dist/test/unit/algo.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate with long inline test vectors. | ai | |
| source-diff | obfuscated-file:dist/test/unit/algoIsWalletAddress.js | AI (source-diff): Compiled TypeScript unit test; long lines from inline test data. | ai | |
| source-diff | obfuscated-file:dist/test/unit/algoToken.js | AI (source-diff): Compiled TypeScript unit test; long lines from inline test data. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/transactionBuilder/assetTransferBuilder.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/transactionBuilder/base.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/keyPair.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/transactionBuilder/keyRegistrationBuilder.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/fixtures/resources.js | AI (source-diff): Test fixture data file; long lines are serialized test data. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/transaction.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/transactionBuilder/transactionBuilderFactory.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/transactionBuilder/transferBuilder.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/utils.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| source-diff | obfuscated-file:dist/test/unit/verifyTransaction.js | AI (source-diff): Compiled TypeScript unit test; standard TS boilerplate. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): bitgobot is BitGo's automated publishing account; consistent with org-wide bot-based publishing pattern. | ai | |
| provenance | no-provenance | AI (provenance): BitGo monorepo packages consistently lack Sigstore provenance; stable false positive for this publisher. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 2.8.8 | 12 / 4 | |
| 1.3.18 | 13 / 4 | |
| 1.3.2 | 13 / 4 | |
| 1.1.0 | 13 / 4 |
v1.3.18
2 findingsThis version was published by a different npm account (bitgobot) than the most recent previously approved version (bitgoaaron) on 2023-05-22. It has since remained available on npm for 1158 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.2
2 findingsThis version was published by a different npm account (bitgobot) than the most recent previously approved version (bitgoaaron) on 2022-11-03. It has since remained available on npm for 1358 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.