@bitgo-beta/sdk-coin-avaxp
BitGo's SDK coin library for avaxp coin
2
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
bitgobot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed to GitHub Actions with SLSA provenance attestation; legitimate CI/CD transition for BitGo org. | ai | |
| source-diff | obfuscated-file:dist/src/lib/atomicInCTransactionBuilder.js | AI (source-diff): TypeScript compiler output with long lines from hex test data; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/src/lib/deprecatedTransaction.js | AI (source-diff): Standard tsc CommonJS output; long lines are blockchain hex fixtures. | ai | |
| source-diff | obfuscated-file:dist/src/lib/deprecatedTransactionBuilder.js | AI (source-diff): Standard tsc CommonJS output; long lines are blockchain hex fixtures. | ai | |
| source-diff | obfuscated-file:dist/test/resources/tx/exportC.js | AI (source-diff): Test resource file with hex-encoded AVAX transaction data; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/exportC2PTxBuilder.js | AI (source-diff): Standard tsc test output with CommonJS boilerplate; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/src/lib/exportInCTxBuilder.js | AI (source-diff): Standard tsc CommonJS output; long lines are blockchain hex fixtures. | ai | |
| source-diff | obfuscated-file:dist/src/lib/permissionlessValidatorTxBuilder.js | AI (source-diff): Standard tsc CommonJS output; long lines are blockchain hex fixtures. | ai | |
| source-diff | obfuscated-file:dist/test/unit/lib/permissionlessValidatorTxBuilder.js | AI (source-diff): Standard tsc test output with CommonJS boilerplate; not obfuscated. | ai | |
| source-diff | encoded-string-file:dist/test/resources/avaxp.js | AI (source-diff): Long strings are hex-encoded AVAX blockchain transaction test fixtures; expected for this package. | ai | |
| source-diff | encoded-string-file:dist/test/resources/tx/importC.js | AI (source-diff): Long strings are hex-encoded AVAX blockchain transaction test fixtures. | ai | |
| source-diff | encoded-string-file:dist/test/resources/tx/importP.js | AI (source-diff): Long strings are hex-encoded AVAX blockchain transaction test fixtures. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): BitGo migrated publishing to bitgobot/GitHub Actions CI with SLSA provenance; consistent with org-wide CI/CD transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): bitgobot is BitGo's CI bot; addition is consistent with org-wide automation transition. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): bitgoaaron removed as part of BitGo's shift to CI-based publishing; not a hostile takeover. | ai | |
| provenance | no-provenance | AI (provenance): BitGo monorepo packages consistently lack Sigstore provenance; stable false positive for this package family. | ai |