@bitgo/sdk-coin-hbar — Greenflagged

BitGo SDK coin library for Hbar

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

louib-bitgobitgobot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@bitgo/sdk-coin-algo	AI (phantom-deps): Same org scope; stable false positive for this BitGo coin module.	ai	2026/05/17
phantom-deps	phantom-dep:@bitgo/statics	AI (phantom-deps): Same org scope; stable false positive for this BitGo coin module.	ai	2026/05/17
phantom-deps	phantom-dep:@hashgraph/sdk	AI (phantom-deps): Core Hedera SDK dep; stable false positive for this coin module.	ai	2026/05/17
phantom-deps	phantom-dep:@bitgo/sdk-core	AI (phantom-deps): Same org scope; stable false positive for this BitGo coin module.	ai	2026/05/17
phantom-deps	phantom-dep:@hashgraph/proto	AI (phantom-deps): Hedera proto dep; stable false positive for this coin module.	ai	2026/05/17
phantom-deps	phantom-dep:@stablelib/sha384	AI (phantom-deps): Stable false positive; crypto dep used via config/indirect imports.	ai	2026/05/17
phantom-deps	phantom-dep:long	AI (phantom-deps): All phantom deps are legitimate runtime dependencies referenced in config/type files for this Hedera SDK coin module.	ai	2026/05/17
phantom-deps	phantom-dep:lodash	AI (phantom-deps): Stable false positive for this package; lodash is a real transitive/config-referenced dep.	ai	2026/05/17
phantom-deps	phantom-dep:tweetnacl	AI (phantom-deps): Stable false positive; tweetnacl used via config/indirect imports in this coin module.	ai	2026/05/17
phantom-deps	phantom-dep:stellar-sdk	AI (phantom-deps): Stable false positive; stellar-sdk referenced in config files for this coin module.	ai	2026/05/17
phantom-deps	phantom-dep:bignumber.js	AI (phantom-deps): Stable false positive; bignumber.js is a real dep used via config/indirect imports.	ai	2026/05/17
source-diff	obfuscated-file:dist/src/lib/accountUpdateBuilder.js	AI (source-diff): Standard tsc CommonJS output with inline sourcemaps; long lines are base64 sourcemap data, not obfuscation.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transactionBuilder/accountUpdateBuilder.js	AI (source-diff): Standard tsc test output; long lines from inline sourcemaps.	ai	2026/05/17
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of individual BitGo employee accounts in favor of bot account is an org-level policy change, not a takeover.	ai	2026/05/17
maintainer-change	maintainer-added	AI (maintainer-change): bitgobot is BitGo's established publishing bot with 117 approved packages.	ai	2026/05/17
maintainer-change	maintainer-takeover	AI (maintainer-change): BitGo consolidating to bitgobot automation account; 117 approved packages, consistent org-wide pattern.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transactionBuilder/walletInitialization.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transactionBuilder/tokenTransferBuilder.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transaction.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transactionBuilder/transferBuilder.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/utils.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/fixtures/hbar.js	AI (source-diff): Long lines are hex-encoded transaction test fixtures, not obfuscated malware.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/resources/hbar.js	AI (source-diff): Compiled TypeScript test resource file with inline source maps; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/hbar.js	AI (source-diff): Compiled TypeScript test file with inline source map; long lines are base64 source maps.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/hbarToken.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/keyPair.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transactionBuilder/tokenAssociateBuilder.js	AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package.	ai	2026/05/17
provenance	publisher-changed	AI (provenance): zahin-mohammad is an established BitGo publisher (63 approved, 0 rejected); transition from mohammadalfaiyaz_bitgo appears to be an internal team change.	ai	2026/05/17
source-diff	obfuscated-file:dist/test/unit/transactionBuilder/coinTransferBuilder.js	AI (source-diff): TypeScript-compiled test file with standard TS helper boilerplate; not obfuscated.	ai	2026/05/17
source-diff	encoded-string-file:dist/test/unit/hbar.js	AI (source-diff): Long hex strings are Hedera serialized transaction test fixtures, not malicious payloads.	ai	2026/05/17
phantom-deps	phantom-dep:protobufjs	AI (phantom-deps): protobufjs is explicitly declared as a direct dependency in package.json; phantom-dep is a false positive here.	ai	2026/05/17

Versions (showing 51 of 75)

View all versions

Version	Deps	Published
2.11.0	12 / 2	2026-06-04
2.10.3	12 / 2	2026-06-03
2.10.2	12 / 2	2026-06-02
2.10.0	12 / 2	2026-05-26
2.9.1	12 / 2	2026-05-22
2.9.0	12 / 2	2026-05-14
2.8.3	12 / 2	2026-05-05
2.8.2	12 / 2	2026-04-29
2.8.1	12 / 2	2026-04-28
2.8.0	12 / 2	2026-04-22
2.7.3	12 / 2	2026-04-14
2.7.2	12 / 2	2026-04-10
2.7.1	12 / 2	2026-04-08
2.7.0	12 / 2	2026-03-29
2.6.9	12 / 2	2026-03-27
2.6.8	12 / 2	2026-03-18
2.6.7	12 / 2	2026-03-10
2.6.6	12 / 2	2026-03-05
2.6.5	12 / 2	2026-03-03
2.6.4	12 / 2	2026-02-27
2.6.3	12 / 2	2026-02-24
2.6.2	12 / 2	2026-02-13
2.6.1	12 / 2	2026-02-12
2.6.0	12 / 2	2026-01-30
2.5.18	12 / 2	2026-01-22
2.5.16	12 / 2	2026-01-14
2.5.15	12 / 2	2026-01-07
2.5.14	12 / 2	2025-12-23
2.5.13	12 / 2	2025-12-17
2.5.12	12 / 2	2025-12-11
2.5.11	12 / 2	2025-12-05
2.5.10	12 / 2	2025-12-04
2.5.9	12 / 2	2025-11-26
2.5.8	12 / 2	2025-11-19
2.5.7	12 / 2	2025-11-13
2.5.6	12 / 2	2025-11-12
2.5.5	12 / 2	2025-11-06
2.5.4	12 / 2	2025-10-31
2.5.3	12 / 2	2025-10-29
2.5.2	12 / 2	2025-10-24
2.5.1	12 / 2	2025-10-21
2.5.0	12 / 2	2025-10-16
2.4.5	12 / 2	2025-10-13
2.4.4	12 / 2	2025-10-09
2.4.3	12 / 2	2025-10-08
2.4.2	12 / 2	2025-10-02
2.4.1	12 / 2	2025-09-29
2.4.0	12 / 2	2025-09-25
2.3.4	12 / 2	2025-09-03
2.3.3	12 / 2	2025-08-30
2.3.2	12 / 2	2025-08-29

v2.11.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.9.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.9.0

3 findings

HIGH New obfuscated file: dist/test/unit/transactionBuilder/coinTransferBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/test/unit/hbar.js source-diff

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.1

16 findings

HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (pengyuc_bitgo, dhoffmann, bitgoaaron, mmcshinsky-bitgo, ericcrosson-bitgo, johntzanakakisbitgo, margueriteblair, pranavjain, islamaminbitgo, mkottaichamy, zahin-mohammad, mohammadalfaiyaz_bitgo) were replaced by new maintainers (louib-bitgo, bitgobot). This is a strong signal of a potential package hijack and requires careful review.

HIGH Publisher changed: mohammadalfaiyaz_bitgo → GitHub Actions (on 2026-04-28) provenance

This version was published by a different npm account than previous versions on 2026-04-28. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/src/lib/accountUpdateBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/transactionBuilder/accountUpdateBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/fixtures/hbar.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/resources/hbar.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/hbar.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/hbarToken.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/keyPair.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/transactionBuilder/tokenAssociateBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/transactionBuilder/tokenTransferBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/transaction.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/transactionBuilder/transferBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/test/unit/transactionBuilder/walletInitialization.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.8.0

16 findings

HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (pengyuc_bitgo, dhoffmann, bitgoaaron, mmcshinsky-bitgo, ericcrosson-bitgo, johntzanakakisbitgo, margueriteblair, pranavjain, islamaminbitgo, mkottaichamy, zahin-mohammad, mohammadalfaiyaz_bitgo) were replaced by new maintainers (louib-bitgo, bitgobot). This is a strong signal of a potential package hijack and requires careful review.

HIGH Publisher changed: mohammadalfaiyaz_bitgo → GitHub Actions (on 2026-04-22) provenance

This version was published by a different npm account than previous versions on 2026-04-22. This could indicate a legitimate maintainer transition or an account compromise.