@celo/wallet-ledger
5
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
app-toolingjcortejosoalvarof2pahor
Keywords
celoblockchainsdk
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:lib/data.js | AI (source-diff): Long base64 strings are Celo token metadata signed by known maintainer; documented pattern for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher with SLSA provenance is a supply-chain improvement, not a compromise signal. | ai | |
| source-diff | encoded-string-file:lib/data.d.ts | AI (source-diff): Type declaration mirrors the token metadata base64 in data.js; same benign pattern. | ai | |
| dependencies | unvetted-dep:@celo/hw-app-eth | AI (dependencies): @celo/hw-app-eth is a Celo-maintained Ledger Ethereum app library, appropriate and expected for this Ledger wallet implementation package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in test-utils.js is standard cryptographic test scaffolding (converting private key string to buffer for ecsign). No malicious payload hiding; open-source code in celo-org repo. | ai | |
| phantom-deps | phantom-dep:@ledgerhq/hw-transport | AI (phantom-deps): @ledgerhq/hw-transport is a legitimate runtime dependency declared in package.json; used as a transport abstraction layer. Phantom detection is a false positive for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding in tokens.js is consistent with decoding token metadata for a Ledger wallet SDK. Open-source code in celo-org/developer-tooling repo; no obfuscation. | ai |