@bitgo/sdk-coin-ada MIT 16 versions

@bitgo/sdk-coin-ada

npm Repository Homepage

BitGo SDK coin library for Ada

16

Versions

MIT

License

No

Install Scripts

Attested

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

louib-bitgobitgobot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-takeover	AI (maintainer-change): bitgobot is BitGo's known automated publisher across the @bitgo/* monorepo.	ai	2026/07/16
maintainer-change	maintainer-added	AI (maintainer-change): Routine BitGo monorepo publisher rotation to bitgobot.	ai	2026/07/16
source-diff	obfuscated-file:dist/src/lib/messages/cip8/utils.js	AI (source-diff): Compiled TS helper file, not obfuscated malware.	ai	2026/07/16
source-diff	obfuscated-file:dist/src/lib/messages/cip8/cip8Message.js	AI (source-diff): Compiled TS source, standard tsc boilerplate.	ai	2026/07/16
source-diff	obfuscated-file:dist/test/unit/ada.js	AI (source-diff): Compiled TS test file with sourcemap, not obfuscation.	ai	2026/07/16
maintainer-change	maintainer-removed	AI (maintainer-change): BitGo monorepo maintainer list normalization via trusted bitgobot publisher.	ai	2026/07/16
provenance	publisher-changed	AI (provenance): bitgobot is BitGo's trusted CI publisher with strong track record.	ai	2026/07/16
publish-pattern	new-deps-added	AI (publish-pattern): bs58/cbor are standard encoding libs needed for new Cardano vote delegation feature.	ai	2026/07/16
source-diff	obfuscated-file:dist/src/lib/voteDelegationBuilder.js	AI (source-diff): tsc-compiled boilerplate, not true obfuscation; part of legit BitGo coin library.	ai	2026/07/16
phantom-deps	phantom-dep:@emurgo/cardano-serialization-lib-browser	AI (phantom-deps): Cardano serialization lib browser variant is a declared dep used conditionally; stable false positive for this package.	ai	2026/05/17
phantom-deps	phantom-dep:lodash	AI (phantom-deps): lodash is a declared runtime dependency; phantom-dep heuristic fires incorrectly for this package.	ai	2026/05/17

Versions (showing 16 of 116)

Version	Deps	Published
4.2.3	10 / 2	2024-07-04
4.2.2	10 / 2	2024-07-02
4.2.1	10 / 2	2024-06-27
4.2.0	10 / 2	2024-06-26
4.1.19	10 / 2	2024-06-21
4.1.18	10 / 2	2024-06-20
4.1.17	10 / 2	2024-06-14
4.1.16	10 / 2	2024-06-11
4.1.15	10 / 2	2024-06-05
4.1.14	10 / 2	2024-05-31
4.1.13	10 / 2	2024-05-28
4.1.12	10 / 2	2024-05-22
4.1.11	10 / 2	2024-05-17
4.1.10	10 / 2	2024-05-13
4.1.9	10 / 2	2024-05-08
4.1.8	10 / 2	2024-05-01

v4.2.3

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: alebusse → mohammadalfaiyaz_bitgo (on 2024-07-04, known maintainer) provenance

This version was published by a different npm account (mohammadalfaiyaz_bitgo) than the most recent previously approved version (alebusse) on 2024-07-04, but mohammadalfaiyaz_bitgo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.2.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: alebusse → mohammadalfaiyaz_bitgo (on 2024-07-02, known maintainer) provenance

This version was published by a different npm account (mohammadalfaiyaz_bitgo) than the most recent previously approved version (alebusse) on 2024-07-02, but mohammadalfaiyaz_bitgo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.19

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: margueriteblair → alebusse (on 2024-06-21, known maintainer) provenance

This version was published by a different npm account (alebusse) than the most recent previously approved version (margueriteblair) on 2024-06-21, but alebusse is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.18

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: margueriteblair → alebusse (on 2024-06-20, known maintainer) provenance

This version was published by a different npm account (alebusse) than the most recent previously approved version (margueriteblair) on 2024-06-20, but alebusse is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.16

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: margueriteblair → pengyuc_bitgo (on 2024-06-11, known maintainer) provenance

This version was published by a different npm account (pengyuc_bitgo) than the most recent previously approved version (margueriteblair) on 2024-06-11, but pengyuc_bitgo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.15

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zahin-mohammad → margueriteblair (on 2024-06-05, known maintainer) provenance

This version was published by a different npm account (margueriteblair) than the most recent previously approved version (zahin-mohammad) on 2024-06-05, but margueriteblair is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.14

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zahin-mohammad → alebusse (on 2024-05-31, known maintainer) provenance

This version was published by a different npm account (alebusse) than the most recent previously approved version (zahin-mohammad) on 2024-05-31, but alebusse is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.13

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: margueriteblair → zahin-mohammad (on 2024-05-28, known maintainer) provenance

This version was published by a different npm account (zahin-mohammad) than the most recent previously approved version (margueriteblair) on 2024-05-28, but zahin-mohammad is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.12

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: margueriteblair → pengyuc_bitgo (on 2024-05-22, known maintainer) provenance

This version was published by a different npm account (pengyuc_bitgo) than the most recent previously approved version (margueriteblair) on 2024-05-22, but pengyuc_bitgo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.10

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: pengyuc_bitgo → margueriteblair (on 2024-05-13, known maintainer) provenance

This version was published by a different npm account (margueriteblair) than the most recent previously approved version (pengyuc_bitgo) on 2024-05-13, but margueriteblair is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.1.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.