@bitgo/statics
dependency-free static configuration for the bitgo platform
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/src/coins/erc7984Tokens.js | AI (source-diff): Long lines are readable TS-compiled JS with inline address comments, not obfuscation; pattern stable for this package's token definition files. | ai | |
| source-diff | obfuscated-file:dist/src/kaspa.js | AI (source-diff): Readable compiled TS coin definition; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/src/coins/cantonTokens.js | AI (source-diff): Long lines are inline token registry data arrays, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/src/coins/generateERC20.js | AI (source-diff): Long lines are inline ERC20 config data, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/src/hypeevm.js | AI (source-diff): Long lines are inline coin feature arrays, not obfuscation. Stable pattern for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Migration to GitHub Actions CI/CD with SLSA provenance; consistent with BitGo's supply chain hardening. | ai |
Versions (showing 45 of 45)
| Version | Deps | Published |
|---|---|---|
| 58.47.0 | 0 / 1 | |
| 58.46.0 | 0 / 1 | |
| 58.45.0 | 0 / 1 | |
| 58.44.0 | 0 / 1 | |
| 58.43.0 | 0 / 1 | |
| 58.42.0 | 0 / 1 | |
| 58.41.0 | 0 / 1 | |
| 58.40.0 | 0 / 1 | |
| 58.39.0 | 0 / 1 | |
| 58.38.0 | 0 / 1 | |
| 58.37.0 | 0 / 1 | |
| 58.36.0 | 0 / 1 | |
| 58.35.0 | 0 / 1 | |
| 58.34.0 | 0 / 1 | |
| 58.33.0 | 0 / 1 | |
| 58.32.0 | 0 / 1 | |
| 58.31.0 | 0 / 1 | |
| 58.30.0 | 0 / 1 | |
| 58.29.0 | 0 / 1 | |
| 58.28.0 | 0 / 1 | |
| 58.27.0 | 0 / 1 | |
| 58.26.0 | 0 / 1 | |
| 58.25.0 | 0 / 1 | |
| 58.24.0 | 0 / 1 | |
| 58.23.0 | 0 / 1 | |
| 58.21.0 | 0 / 1 | |
| 58.20.0 | 0 / 1 | |
| 58.19.0 | 0 / 1 | |
| 58.18.0 | 0 / 1 | |
| 58.17.0 | 0 / 1 | |
| 58.16.1 | 0 / 1 | |
| 58.16.0 | 0 / 1 | |
| 58.15.0 | 0 / 1 | |
| 58.14.0 | 0 / 1 | |
| 58.13.0 | 0 / 1 | |
| 58.12.0 | 0 / 1 | |
| 58.11.0 | 0 / 1 | |
| 58.10.0 | 0 / 1 | |
| 58.9.0 | 0 / 1 | |
| 58.8.0 | 0 / 1 | |
| 58.7.0 | 0 / 1 | |
| 58.6.0 | 0 / 1 | |
| 58.5.0 | 0 / 1 | |
| 58.4.0 | 0 / 1 | |
| 58.3.0 | 0 / 1 |
v58.32.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v58.31.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v58.30.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (bitgobot) on 2026-03-10, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v58.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.27.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.26.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.25.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.24.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.21.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.20.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.19.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.18.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.17.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.16.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.16.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.14.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v58.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.