@bitgo/sdk-coin-sol
BitGo SDK coin library for Sol
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/cjs/test/unit/transactionBuilder/closeAtaBuilder.js | AI (source-diff): Standard tsc CJS interop boilerplate in a test file, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/test/unit/register.js | AI (source-diff): Compiled mocha test file, not obfuscated malicious code. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine roster change within BitGo monorepo, not a takeover indicator. | ai | |
| source-diff | encoded-string-file:dist/test/resources/sol.d.ts | AI (source-diff): Type declarations mirroring the same test fixture constants. | ai | |
| source-diff | encoded-string-file:dist/test/resources/sol.js | AI (source-diff): Test fixtures: base58/base64 Solana keys and tx blobs, not hidden payloads. | ai | |
| source-diff | obfuscated-file:dist/test/unit/versionedTransaction.js | AI (source-diff): Compiled TS test file with tsc helper boilerplate, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/src/bigint-buffer-guard.js | AI (source-diff): Defensive input-validation wrapper, not obfuscation; readable source shown. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Expected from added dual CJS/ESM build output, not injected code. | ai | |
| source-diff | obfuscated-file:dist/cjs/src/lib/recoverNestedAtaBuilder.js | AI (source-diff): Normal TS-compiled builder class; no obfuscation present in sample. | ai | |
| source-diff | obfuscated-file:dist/cjs/test/unit/explainTransactionWasm.js | AI (source-diff): Long line is a base64 tx fixture in a test file, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/esm/lib/recoverNestedAtaBuilder.js | AI (source-diff): Same builder file, ESM build; benign. | ai | |
| source-diff | encoded-string-file:dist/cjs/test/unit/jitoWasmVerification.js | AI (source-diff): Base64 test transaction fixture, not a hidden payload. | ai | |
| source-diff | encoded-string-file:dist/cjs/test/unit/sol.js | AI (source-diff): Base64 tx fixtures used across many BitGo coin test suites. | ai | |
| source-diff | encoded-string-file:dist/test/unit/sol.js | AI (source-diff): Long encoded strings are Solana transaction hex/base64 test fixtures, not obfuscated payloads. Stable pattern for this package. | ai | |
| provenance | no-provenance | AI (provenance): BitGo publishes the entire SDK monorepo without Sigstore provenance; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@bitgo/logger | AI (dependencies): Internal BitGo monorepo dependency; expected for this package family. | ai | |
| dependencies | unvetted-dep:@bitgo/wasm-solana | AI (dependencies): Internal BitGo monorepo dependency; expected for this package family. | ai | |
| dependencies | unvetted-dep:@bitgo/sdk-lib-mpc | AI (dependencies): Internal BitGo monorepo dependency; expected for this package family. | ai | |
| dependencies | unvetted-dep:@solana/spl-stake-pool | AI (dependencies): Well-known Solana ecosystem library; stable dependency for this SDK coin module. | ai | |
| dependencies | unvetted-dep:@bitgo/sdk-core | AI (dependencies): Internal BitGo monorepo dependency; expected for this package family. | ai |
Versions (showing 60 of 60)
| Version | Deps | Published |
|---|---|---|
| 8.1.1 | 14 / 3 | |
| 8.0.1 | 14 / 3 | |
| 8.0.0 | 14 / 3 | |
| 7.26.1 | 14 / 3 | |
| 7.26.0 | 14 / 3 | |
| 7.25.0 | 14 / 3 | |
| 7.24.0 | 14 / 3 | |
| 7.23.1 | 14 / 3 | |
| 7.23.0 | 14 / 3 | |
| 7.22.1 | 14 / 3 | |
| 7.22.0 | 14 / 3 | |
| 7.21.1 | 14 / 3 | |
| 7.21.0 | 14 / 3 | |
| 7.20.1 | 14 / 3 | |
| 7.20.0 | 14 / 3 | |
| 7.19.4 | 14 / 3 | |
| 7.19.3 | 14 / 3 | |
| 7.19.2 | 14 / 3 | |
| 7.19.1 | 14 / 3 | |
| 7.19.0 | 14 / 3 | |
| 7.18.4 | 14 / 3 | |
| 7.18.3 | 14 / 3 | |
| 7.18.2 | 14 / 3 | |
| 7.18.1 | 14 / 3 | |
| 7.18.0 | 14 / 3 | |
| 7.17.0 | 14 / 3 | |
| 7.16.3 | 14 / 3 | |
| 7.16.2 | 14 / 3 | |
| 7.16.1 | 14 / 3 | |
| 7.16.0 | 14 / 3 | |
| 7.15.0 | 14 / 3 | |
| 7.14.0 | 14 / 3 | |
| 7.13.1 | 13 / 3 | |
| 7.13.0 | 13 / 3 | |
| 7.12.0 | 12 / 3 | |
| 7.11.4 | 12 / 3 | |
| 7.11.2 | 12 / 3 | |
| 7.11.1 | 12 / 3 | |
| 7.11.0 | 12 / 3 | |
| 7.10.4 | 12 / 3 | |
| 7.10.3 | 12 / 3 | |
| 7.10.2 | 12 / 3 | |
| 7.10.1 | 12 / 3 | |
| 7.10.0 | 12 / 3 | |
| 7.9.0 | 12 / 3 | |
| 7.8.0 | 12 / 3 | |
| 7.7.0 | 12 / 3 | |
| 7.6.3 | 12 / 3 | |
| 7.6.2 | 12 / 3 | |
| 7.6.1 | 12 / 3 | |
| 7.6.0 | 12 / 3 | |
| 7.5.0 | 12 / 3 | |
| 7.4.0 | 12 / 3 | |
| 7.3.0 | 12 / 3 | |
| 7.2.3 | 12 / 3 | |
| 7.2.2 | 12 / 3 | |
| 7.2.1 | 12 / 3 | |
| 7.2.0 | 12 / 3 | |
| 7.1.0 | 12 / 3 | |
| 7.0.0 | 12 / 3 |
v8.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.0.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.0.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.26.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.26.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.19.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.18.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.18.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (bitgobot) on 2026-03-29, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v7.17.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (bitgobot) on 2026-03-27, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v7.16.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.16.2
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (bitgobot) on 2026-03-10, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v7.16.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.15.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.4.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 110 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 110 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.3.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 110 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 110 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.