@eco-foundation/routes
The Eco Routes Protocol is a decentralized intent based system that allows users to submit their intent to the network and have it fulfilled by a solver on the destination rollup of their choise.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:hex-decode | AI (semgrep): Standard Buffer.from(hex,'hex') conversion in a blockchain SDK utility; not obfuscation. | ai | |
| phantom-deps | phantom-dep:@metalayer/contracts | AI (phantom-deps): Contract dependency declared for Solidity compilation, not direct TS import — stable FP. | ai | |
| phantom-deps | phantom-dep:@hyperlane-xyz/registry | AI (phantom-deps): Registry package used at build/config time, not direct TS import — stable FP. | ai | |
| phantom-deps | phantom-dep:@openzeppelin/contracts | AI (phantom-deps): OpenZeppelin Solidity contracts; depcheck ignores list confirms intentional — stable FP. | ai | |
| phantom-deps | phantom-dep:@hyperlane-xyz/sdk | AI (phantom-deps): Solidity/contract package; declared for type resolution, not direct TS import — stable FP for this package. | ai | |
| phantom-deps | phantom-dep:@axelar-network/axelar-gmp-sdk-solidity | AI (phantom-deps): Axelar Solidity SDK; used at compile time, not direct TS import — stable FP. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): axios is a runtime dep used in scripts/config; phantom-dep heuristic FP for this package. | ai | |
| phantom-deps | phantom-dep:tronweb | AI (phantom-deps): tronweb used in Tron deploy scripts; phantom-dep heuristic FP for this package. | ai | |
| phantom-deps | phantom-dep:@openzeppelin/contracts-upgradeable | AI (phantom-deps): OpenZeppelin upgradeable contracts; depcheck ignores list confirms intentional — stable FP. | ai |
v3.2.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.