@cosmjs/amino
Helpers for Amino based signing.
51
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
webmaster128kiki-skip
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance adoption; publisher has strong track record. Low risk for this established ecosystem package. | ai | |
| provenance | missing-githead | AI (provenance): CosmJS is a well-established project; missing gitHead reflects a publish environment change, not a supply chain compromise. Publisher has 168 approved packages and 0 rejections. | ai | |
| source-diff | encoded-string-file:build/testutils.spec.js | AI (source-diff): Long strings are Bech32-encoded public keys used as test fixtures in a Cosmos cryptography library — not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:build/testutils.spec.d.ts | AI (source-diff): Long strings are Bech32-encoded public keys in TypeScript declaration test fixtures — not obfuscated payloads. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Signals (short README, no keywords) are cosmetic and not indicative of malicious intent for this well-known CosmJS library. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from webmaster128 to willclarktech occurred in 2021 as a legitimate CosmJS org transition; willclarktech has 86 approved packages and 0 rejected since then. | ai | |
| dependencies | unvetted-dep:@cosmjs/encoding | AI (dependencies): Sibling package from the same CosmJS monorepo, published by the same trusted maintainer. | ai | |
| dependencies | unvetted-dep:@cosmjs/crypto | AI (dependencies): Sibling package from the same CosmJS monorepo, published by the same trusted maintainer. | ai | |
| dependencies | unvetted-dep:@cosmjs/utils | AI (dependencies): Sibling package from the same CosmJS monorepo, published by the same trusted maintainer. | ai | |
| dependencies | unvetted-dep:@cosmjs/math | AI (dependencies): Sibling package from the same CosmJS monorepo, published by the same trusted maintainer. | ai | |
| typosquat | typosquat.levenshtein:pino | AI (typosquat): @cosmjs/amino is a scoped Cosmos blockchain package with no relation to 'pino'. The Levenshtein match is purely coincidental; this is a stable false positive for this package. | ai |
Versions (showing 51 of 64)
| Version | Deps | Published |
|---|---|---|
| 0.39.0 | 4 / 21 | |
| 0.38.1 | 4 / 21 | |
| 0.38.0 | 4 / 21 | |
| 0.37.1 | 4 / 21 | |
| 0.37.0 | 4 / 21 | |
| 0.36.2 | 4 / 21 | |
| 0.36.1 | 4 / 21 | |
| 0.36.0 | 4 / 21 | |
| 0.35.2 | 4 / 21 | |
| 0.35.1 | 4 / 21 | |
| 0.35.0 | 4 / 21 | |
| 0.34.1 | 4 / 23 | |
| 0.34.0 | 4 / 23 | |
| 0.33.1 | 4 / 32 | |
| 0.33.0 | 4 / 32 | |
| 0.32.4 | 4 / 32 | |
| 0.32.3 | 4 / 32 | |
| 0.32.2 | 4 / 32 | |
| 0.32.1 | 4 / 32 | |
| 0.32.0 | 4 / 32 | |
| 0.31.3 | 4 / 32 | |
| 0.31.2 | 4 / 32 | |
| 0.31.1 | 4 / 32 | |
| 0.31.0 | 4 / 32 | |
| 0.30.1 | 4 / 32 | |
| 0.30.0 | 4 / 32 | |
| 0.29.5 | 4 / 32 | |
| 0.29.4 | 4 / 32 | |
| 0.29.3 | 4 / 32 | |
| 0.29.2 | 4 / 32 | |
| 0.29.1 | 4 / 32 | |
| 0.29.0 | 4 / 32 | |
| 0.28.13 | 4 / 32 | |
| 0.28.11 | 4 / 32 | |
| 0.28.10 | 4 / 32 | |
| 0.28.9 | 4 / 32 | |
| 0.28.7 | 4 / 32 | |
| 0.28.6 | 4 / 32 | |
| 0.28.4 | 4 / 32 | |
| 0.28.3 | 4 / 33 | |
| 0.28.2 | 4 / 33 | |
| 0.28.1 | 4 / 33 | |
| 0.28.0 | 4 / 33 | |
| 0.27.1 | 4 / 34 | |
| 0.27.0 | 4 / 34 | |
| 0.26.8 | 4 / 32 | |
| 0.26.6 | 4 / 34 | |
| 0.26.5 | 4 / 34 | |
| 0.26.4 | 4 / 34 | |
| 0.26.3 | 4 / 34 | |
| 0.26.2 | 4 / 34 |