@chain-registry/utils
Chain Registry Utils
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@keplr-wallet/crypto | AI (dependencies): @keplr-wallet/crypto is a well-known cryptographic library from the Keplr wallet team, a major Cosmos ecosystem project. Its use in chain-registry utils is expected and appropriate. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Part of a large, established monorepo (cosmology-tech/chain-registry) by a trusted publisher; sparse README and missing keywords are cosmetic, not indicative of spam. | ai | |
| dependencies | unvetted-dep:@chain-registry/types | AI (dependencies): @chain-registry/types is a sibling package in the same hyperweb-io/chain-registry monorepo, published by the same trusted author (pyramation). Unvetted status is transient and expected for co-released packages. | ai | |
| dependencies | unvetted-dep:chain-registry | AI (dependencies): chain-registry is a sibling package in the same hyperweb-io/chain-registry monorepo, published by the same trusted author (pyramation). Unvetted status is transient and expected for co-released packages. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): chain-registry is a sibling package in the same hyperweb-io/chain-registry monorepo, published by the same maintainer. Intra-monorepo dependency additions are expected and low-risk for this package. | ai | |
| phantom-deps | phantom-dep:chain-registry | AI (phantom-deps): chain-registry is a sibling monorepo package; indirect/config usage without direct import is a common pattern in this ecosystem. | ai | |
| license | uncommon-license:SEE LICENSE IN LICENSE | AI (license): Standard npm pattern referencing a LICENSE file; common in open-source projects and not a security concern. | ai | |
| provenance | no-provenance | AI (provenance): Package predates widespread provenance adoption; publisher has strong track record. Stable false positive for this package. | ai |
Versions (showing 34 of 841)
| Version | Deps | Published |
|---|---|---|
| 1.9.1 | 3 / 29 | |
| 1.9.0 | 3 / 29 | |
| 1.8.0 | 3 / 29 | |
| 1.7.0 | 3 / 29 | |
| 1.6.0 | 3 / 29 | |
| 1.5.0 | 3 / 29 | |
| 1.4.0 | 3 / 29 | |
| 1.3.0 | 3 / 29 | |
| 1.2.1 | 3 / 29 | |
| 1.2.0 | 3 / 29 | |
| 1.1.0 | 3 / 29 | |
| 1.0.1 | 3 / 29 | |
| 1.0.0 | 5 / 29 | |
| 0.11.0 | 5 / 29 | |
| 0.10.2 | 5 / 29 | |
| 0.10.1 | 5 / 29 | |
| 0.10.0 | 5 / 29 | |
| 0.8.0 | 5 / 29 | |
| 0.7.3 | 5 / 29 | |
| 0.7.2 | 5 / 29 | |
| 0.7.1 | 5 / 29 | |
| 0.7.0 | 4 / 30 | |
| 0.6.3 | 4 / 30 | |
| 0.6.2 | 4 / 30 | |
| 0.6.1 | 4 / 30 | |
| 0.6.0 | 4 / 30 | |
| 0.5.1 | 3 / 28 | |
| 0.5.0 | 3 / 28 | |
| 0.4.0 | 3 / 28 | |
| 0.3.1 | 2 / 28 | |
| 0.3.0 | 2 / 28 | |
| 0.2.1 | 2 / 28 | |
| 0.2.0 | 2 / 24 | |
| 0.1.0 | 2 / 24 |
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.