← Home

@bitgo/utxo-lib

npm Repository Homepage
20
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

louib-bitgobitgobot

Keywords

bitgoutxobitcoinjsbitcoinzcashdashbrowserifyjavascript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): SLSA provenance attestation via Sigstore confirms legitimate CI/CD publish; established BitGo package with strong ecosystem trust. ai
dependencies unvetted-dep:cashaddress AI (dependencies): Standard Bitcoin Cash address library; expected dep for a multi-coin UTXO lib. ai
dependencies unvetted-dep:@bitgo/blake2b AI (dependencies): BitGo-owned blake2b binding; stable dep for this package. ai
dependencies unvetted-dep:@bitgo/secp256k1 AI (dependencies): BitGo-owned secp256k1 binding; stable dep for this package. ai
dependencies unvetted-dep:@brandonblack/musig AI (dependencies): MuSig crypto library for Taproot; expected dep for a UTXO lib supporting Taproot. ai

Versions (showing 20 of 20)

Version Deps Published
11.24.1 12 / 5
11.22.1 12 / 5
11.22.0 12 / 5
11.17.0 12 / 5
11.16.1 12 / 5
11.16.0 12 / 5
11.15.0 12 / 5
11.14.0 12 / 5
11.13.0 12 / 5
11.11.1 17 / 5
11.10.0 17 / 5
11.9.0 17 / 5
11.8.0 17 / 5
11.6.3 17 / 5
11.6.1 17 / 5
11.6.0 17 / 5
11.3.0 17 / 5
11.2.4 17 / 5
11.2.3 17 / 5
11.2.2 17 / 7

v11.24.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.3.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: margueriteblair → mohammadalfaiyaz_bitgo (on 2025-04-04, known maintainer) provenance

This version was published by a different npm account (mohammadalfaiyaz_bitgo) than the most recent previously approved version (margueriteblair) on 2025-04-04, but mohammadalfaiyaz_bitgo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v11.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.