← Home

@bitgo/sdk-coin-hbar

npm Repository Homepage

BitGo SDK coin library for Hbar

100
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

louib-bitgobitgobot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@bitgo/sdk-coin-algo AI (phantom-deps): Same org scope; stable false positive for this BitGo coin module. ai
phantom-deps phantom-dep:@bitgo/statics AI (phantom-deps): Same org scope; stable false positive for this BitGo coin module. ai
phantom-deps phantom-dep:@hashgraph/sdk AI (phantom-deps): Core Hedera SDK dep; stable false positive for this coin module. ai
phantom-deps phantom-dep:@bitgo/sdk-core AI (phantom-deps): Same org scope; stable false positive for this BitGo coin module. ai
phantom-deps phantom-dep:@hashgraph/proto AI (phantom-deps): Hedera proto dep; stable false positive for this coin module. ai
phantom-deps phantom-dep:@stablelib/sha384 AI (phantom-deps): Stable false positive; crypto dep used via config/indirect imports. ai
phantom-deps phantom-dep:long AI (phantom-deps): All phantom deps are legitimate runtime dependencies referenced in config/type files for this Hedera SDK coin module. ai
phantom-deps phantom-dep:lodash AI (phantom-deps): Stable false positive for this package; lodash is a real transitive/config-referenced dep. ai
phantom-deps phantom-dep:tweetnacl AI (phantom-deps): Stable false positive; tweetnacl used via config/indirect imports in this coin module. ai
phantom-deps phantom-dep:stellar-sdk AI (phantom-deps): Stable false positive; stellar-sdk referenced in config files for this coin module. ai
phantom-deps phantom-dep:bignumber.js AI (phantom-deps): Stable false positive; bignumber.js is a real dep used via config/indirect imports. ai
source-diff obfuscated-file:dist/src/lib/accountUpdateBuilder.js AI (source-diff): Standard tsc CommonJS output with inline sourcemaps; long lines are base64 sourcemap data, not obfuscation. ai
source-diff obfuscated-file:dist/test/unit/transactionBuilder/accountUpdateBuilder.js AI (source-diff): Standard tsc test output; long lines from inline sourcemaps. ai
maintainer-change maintainer-removed AI (maintainer-change): Removal of individual BitGo employee accounts in favor of bot account is an org-level policy change, not a takeover. ai
maintainer-change maintainer-added AI (maintainer-change): bitgobot is BitGo's established publishing bot with 117 approved packages. ai
maintainer-change maintainer-takeover AI (maintainer-change): BitGo consolidating to bitgobot automation account; 117 approved packages, consistent org-wide pattern. ai
source-diff obfuscated-file:dist/test/unit/transactionBuilder/walletInitialization.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/transactionBuilder/tokenTransferBuilder.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/transaction.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/transactionBuilder/transferBuilder.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/utils.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/fixtures/hbar.js AI (source-diff): Long lines are hex-encoded transaction test fixtures, not obfuscated malware. ai
source-diff obfuscated-file:dist/test/resources/hbar.js AI (source-diff): Compiled TypeScript test resource file with inline source maps; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/hbar.js AI (source-diff): Compiled TypeScript test file with inline source map; long lines are base64 source maps. ai
source-diff obfuscated-file:dist/test/unit/hbarToken.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/keyPair.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
source-diff obfuscated-file:dist/test/unit/transactionBuilder/tokenAssociateBuilder.js AI (source-diff): Compiled TypeScript test file with inline source map; benign for this package. ai
provenance publisher-changed AI (provenance): zahin-mohammad is an established BitGo publisher (63 approved, 0 rejected); transition from mohammadalfaiyaz_bitgo appears to be an internal team change. ai
source-diff obfuscated-file:dist/test/unit/transactionBuilder/coinTransferBuilder.js AI (source-diff): TypeScript-compiled test file with standard TS helper boilerplate; not obfuscated. ai
source-diff encoded-string-file:dist/test/unit/hbar.js AI (source-diff): Long hex strings are Hedera serialized transaction test fixtures, not malicious payloads. ai
phantom-deps phantom-dep:protobufjs AI (phantom-deps): protobufjs is explicitly declared as a direct dependency in package.json; phantom-dep is a false positive here. ai

Versions (showing 100 of 153)

Version Deps Published
3.0.4 12 / 2
3.0.3 12 / 2
3.0.1 12 / 2
3.0.0 12 / 2
2.12.6 12 / 2
2.12.5 12 / 2
2.12.4 12 / 2
2.12.3 12 / 2
2.12.2 12 / 2
2.12.1 12 / 2
2.12.0 12 / 2
2.11.0 12 / 2
2.10.3 12 / 2
2.10.2 12 / 2
2.10.0 12 / 2
2.9.1 12 / 2
2.9.0 12 / 2
2.8.3 12 / 2
2.8.2 12 / 2
2.8.1 12 / 2
2.8.0 12 / 2
2.7.3 12 / 2
2.7.2 12 / 2
2.7.1 12 / 2
2.7.0 12 / 2
2.6.9 12 / 2
2.6.8 12 / 2
2.6.7 12 / 2
2.6.6 12 / 2
2.6.5 12 / 2
2.6.4 12 / 2
2.6.3 12 / 2
2.6.2 12 / 2
2.6.1 12 / 2
2.6.0 12 / 2
2.5.18 12 / 2
2.5.16 12 / 2
2.5.15 12 / 2
2.5.14 12 / 2
2.5.13 12 / 2
2.5.12 12 / 2
2.5.11 12 / 2
2.5.10 12 / 2
2.5.9 12 / 2
2.5.8 12 / 2
2.5.7 12 / 2
2.5.6 12 / 2
2.5.5 12 / 2
2.5.4 12 / 2
2.5.3 12 / 2
2.5.2 12 / 2
2.5.1 12 / 2
2.5.0 12 / 2
2.4.5 12 / 2
2.4.4 12 / 2
2.4.3 12 / 2
2.4.2 12 / 2
2.4.1 12 / 2
2.4.0 12 / 2
2.3.4 12 / 2
2.3.3 12 / 2
2.3.2 12 / 2
2.3.1 12 / 2
2.3.0 12 / 2
2.2.15 12 / 2
2.2.14 12 / 2
2.2.13 12 / 2
2.2.12 12 / 2
2.2.11 12 / 2
2.2.10 12 / 2
2.2.9 12 / 2
2.2.8 12 / 2
2.2.7 12 / 2
2.2.6 12 / 2
2.2.5 12 / 2
2.2.4 12 / 2
2.2.3 12 / 2
2.2.2 12 / 2
2.2.1 12 / 2
2.2.0 12 / 2
2.1.0 12 / 2
2.0.82 12 / 2
2.0.81 12 / 2
2.0.80 12 / 2
2.0.79 12 / 2
2.0.78 12 / 2
2.0.77 12 / 2
2.0.76 12 / 2
2.0.75 12 / 2
2.0.74 12 / 2
2.0.73 12 / 2
2.0.72 12 / 2
2.0.71 12 / 2
2.0.70 12 / 2
2.0.69 12 / 2
2.0.68 12 / 2
2.0.67 12 / 2
2.0.66 12 / 2
2.0.65 12 / 2
2.0.64 12 / 2
Showing 100 of 153 Next page →

v3.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.12.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.12.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.77

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.76

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.75

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.74

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.73

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.72

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.71

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.70

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.69

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.68

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.67

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.66

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.65

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.64

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.