@cowprotocol/widget-lib
CoW Swap Widget Library. Allows you to easily embed a CoW Swap widget on your website.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:index.cjs | AI (source-diff): index.cjs is a standard minified CJS build artifact for this library; pattern is stable across versions. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing is confirmed by SLSA provenance attestation; legitimate CI migration for this org. | ai | |
| provenance | missing-githead | AI (provenance): CI/CD publish environments often omit gitHead; SLSA attestation provides stronger commit linkage. | ai | |
| phantom-deps | phantom-dep:@cowprotocol/types | AI (phantom-deps): Same-org type package; likely used as type-only dependency, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@cowprotocol/sdk-bridging | AI (phantom-deps): Same-org package; peer/type dependency pattern, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:eventemitter3 | AI (phantom-deps): Established event emitter library; referenced in config, consistent with widget-lib usage pattern. | ai | |
| phantom-deps | phantom-dep:@uniswap/sdk-core | AI (phantom-deps): Established Uniswap package; type-only or transitive peer dep pattern for DeFi widget library. | ai | |
| phantom-deps | phantom-dep:@web3-react/types | AI (phantom-deps): Type-only dependency pattern; stable false positive for this widget library. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @cowprotocol/cow-sdk is a first-party dep from the same org; low risk for this package. | ai | |
| dependencies | unvetted-dep:@cowprotocol/events | AI (dependencies): First-party sibling package in the cowprotocol/cowswap monorepo; expected dependency. | ai | |
| dependencies | unvetted-dep:@cowprotocol/iframe-transport | AI (dependencies): First-party sibling package in the cowprotocol/cowswap monorepo; expected dependency. | ai |
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 4.0.5 | 3 / 0 | |
| 4.0.4 | 3 / 0 | |
| 4.0.3 | 3 / 0 | |
| 4.0.2 | 3 / 0 | |
| 4.0.1 | 3 / 0 | |
| 4.0.0 | 3 / 0 | |
| 3.1.1 | 3 / 0 | |
| 3.0.0 | 3 / 0 | |
| 2.3.0 | 3 / 0 | |
| 2.2.5 | 3 / 0 | |
| 2.2.4 | 3 / 0 | |
| 2.2.3 | 3 / 0 | |
| 2.1.1 | 3 / 0 | |
| 2.1.0 | 3 / 0 | |
| 2.0.2 | 3 / 0 | |
| 2.0.1 | 9 / 0 | |
| 2.0.0 | 3 / 0 | |
| 1.3.0 | 3 / 0 | |
| 1.2.2 | 3 / 0 | |
| 1.2.1 | 3 / 0 | |
| 1.2.0 | 3 / 0 | |
| 1.1.2 | 3 / 0 | |
| 1.1.1 | 3 / 0 | |
| 0.22.3 | 2 / 0 | |
| 0.22.1 | 2 / 0 | |
| 0.22.0 | 2 / 0 |
v4.0.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.1.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.0
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
This version was published by a different npm account than previous versions on 2026-04-02. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.2
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
This version was published by a different npm account than previous versions on 2026-03-18. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cowprotocol_dev.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.