@cubist-labs/cubesigner-sdk
CubeSigner TypeScript SDK
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/src/audit_log.js | AI (source-diff): Long lines are generated zod discriminatedUnion type definitions, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/src/audit_log.d.ts | AI (source-diff): Long lines are generated TypeScript union type declarations from zod schema, not obfuscated code. | ai | |
| source-diff | encoded-string-file:dist/src/schema.d.ts | AI (source-diff): Long string is a Solana base64 example value in an OpenAPI spec comment, not a payload. | ai | |
| source-diff | encoded-string-file:src/schema.ts | AI (source-diff): Long string is a Solana base64 example value in an OpenAPI spec comment, not a payload. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Routine hex parsing utility in a crypto/signing SDK; not a payload-hiding pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard base64 decode utility in a crypto SDK; expected and benign. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 0.4.254 | 2 / 2 | |
| 0.4.252 | 2 / 2 | |
| 0.4.250 | 2 / 2 | |
| 0.4.247 | 2 / 2 | |
| 0.4.246 | 2 / 2 | |
| 0.4.244 | 2 / 2 | |
| 0.4.241 | 2 / 2 | |
| 0.4.239 | 2 / 2 | |
| 0.4.237 | 1 / 2 | |
| 0.4.236 | 1 / 2 | |
| 0.4.231 | 1 / 2 | |
| 0.4.229 | 1 / 2 | |
| 0.4.228 | 1 / 2 |
v0.4.254
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.252
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.250
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.247
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.246
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.244
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.241
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.239
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.237
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.236
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.231
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.229
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.228
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.