@cosmjs/crypto
Cryptography resources for blockchain projects
40
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
webmaster128kiki-skip
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:elliptic | AI (dependencies): Elliptic is a standard ECDSA library; appropriate for crypto package and widely used in blockchain projects. | ai | |
| phantom-deps | phantom-dep:@cosmjs/utils | AI (phantom-deps): Same-org scoped dependency (@cosmjs/utils) declared in package.json; phantom flag is a false positive for this monorepo package structure. | ai | |
| source-diff | encoded-string-file:build/hmac.spec.js | AI (source-diff): Long hex strings are RFC 4231 HMAC test vectors — standard cryptographic test data, not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:build/libsodium.spec.js | AI (source-diff): Long hex strings are Argon2/libsodium test vectors — standard cryptographic test data, not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:build/secp256k1.spec.js | AI (source-diff): Long hex strings are secp256k1 signature verification test vectors — standard cryptographic test data, not obfuscated payloads. | ai | |
| dependencies | unvetted-dep:hash-wasm | AI (dependencies): hash-wasm is a legitimate WebAssembly hashing library; its use in a cryptography package is expected and appropriate across all versions. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Minor metadata signals (README format, keywords) do not reflect actual code quality or security risk for established library. | ai | |
| typosquat | typosquat.levenshtein:bcrypt | AI (typosquat): @cosmjs/crypto is a scoped package from the established CosmWasm org; no impersonation intent. False positive for legitimate namespace. | ai | |
| dependencies | unvetted-dep:@cosmjs/encoding | AI (dependencies): Sibling package in the same CosmJS monorepo; legitimate dependency, not suspicious. | ai |
Versions (showing 40 of 40)
| Version | Deps | Published |
|---|---|---|
| 0.38.1 | 8 / 22 | |
| 0.38.0 | 8 / 22 | |
| 0.37.1 | 8 / 22 | |
| 0.37.0 | 8 / 22 | |
| 0.36.2 | 7 / 24 | |
| 0.36.1 | 7 / 24 | |
| 0.36.0 | 7 / 24 | |
| 0.35.2 | 6 / 24 | |
| 0.35.1 | 6 / 24 | |
| 0.35.0 | 6 / 24 | |
| 0.34.1 | 7 / 27 | |
| 0.34.0 | 7 / 27 | |
| 0.33.1 | 7 / 37 | |
| 0.33.0 | 7 / 37 | |
| 0.32.1 | 7 / 37 | |
| 0.31.1 | 7 / 37 | |
| 0.31.0 | 7 / 37 | |
| 0.30.1 | 7 / 37 | |
| 0.29.4 | 7 / 37 | |
| 0.29.0 | 7 / 37 | |
| 0.28.13 | 7 / 37 | |
| 0.28.9 | 7 / 37 | |
| 0.28.5 | 7 / 37 | |
| 0.28.3 | 7 / 38 | |
| 0.28.0 | 7 / 38 | |
| 0.26.5 | 10 / 41 | |
| 0.26.4 | 10 / 41 | |
| 0.26.3 | 10 / 41 | |
| 0.26.2 | 10 / 41 | |
| 0.26.1 | 10 / 41 | |
| 0.25.4 | 10 / 5 | |
| 0.25.3 | 10 / 5 | |
| 0.25.2 | 12 / 7 | |
| 0.25.0 | 12 / 7 | |
| 0.24.1 | 12 / 7 | |
| 0.24.0 | 12 / 7 | |
| 0.23.2 | 13 / 7 | |
| 0.21.1 | 13 / 7 | |
| 0.21.0 | 13 / 7 | |
| 0.20.1 | 13 / 7 |