← Home

@cubist-labs/cubesigner-sdk

npm Repository Homepage

CubeSigner TypeScript SDK

27
Versions
MIT OR Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mlfbrown_cubistamilicevicnoetzli

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/src/audit_log.js AI (source-diff): Long lines are generated zod discriminatedUnion type definitions, not obfuscated code. ai
source-diff obfuscated-file:dist/src/audit_log.d.ts AI (source-diff): Long lines are generated TypeScript union type declarations from zod schema, not obfuscated code. ai
source-diff encoded-string-file:dist/src/schema.d.ts AI (source-diff): Long string is a Solana base64 example value in an OpenAPI spec comment, not a payload. ai
source-diff encoded-string-file:src/schema.ts AI (source-diff): Long string is a Solana base64 example value in an OpenAPI spec comment, not a payload. ai
semgrep semgrep:hex-decode AI (semgrep): Routine hex parsing utility in a crypto/signing SDK; not a payload-hiding pattern. ai
semgrep semgrep:base64-decode AI (semgrep): Standard base64 decode utility in a crypto SDK; expected and benign. ai

Versions (showing 27 of 27)

Version Deps Published
0.4.273 2 / 2
0.4.272 2 / 2
0.4.270 2 / 2
0.4.269 2 / 2
0.4.268 2 / 2
0.4.267 2 / 2
0.4.266 2 / 2
0.4.265 2 / 2
0.4.263 2 / 2
0.4.262 2 / 2
0.4.260 2 / 2
0.4.259 2 / 2
0.4.254 2 / 2
0.4.252 2 / 2
0.4.250 2 / 2
0.4.247 2 / 2
0.4.246 2 / 2
0.4.244 2 / 2
0.4.241 2 / 2
0.4.239 2 / 2
0.4.237 1 / 2
0.4.236 1 / 2
0.4.231 1 / 2
0.4.229 1 / 2
0.4.228 1 / 2
0.4.201 1 / 2
0.4.199 1 / 2

v0.4.273

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.272

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.201

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.199

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.