@ethereumjs/evm

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@types/debug	AI (phantom-deps): @types/debug is a legitimate runtime dep for TypeScript type augmentation of the debug package; stable false positive for this package.	ai	2026/04/27
dependencies	unvetted-dep:@ethereumjs/util	AI (dependencies): Sibling package from the same ethereumjs monorepo, versioned in lockstep; expected co-dependency, not a third-party unknown.	ai	2026/04/25
dependencies	unvetted-dep:@ethereumjs/common	AI (dependencies): Sibling package from the same ethereumjs monorepo, versioned in lockstep; expected co-dependency, not a third-party unknown.	ai	2026/04/25
dependencies	unvetted-dep:@ethereumjs/binarytree	AI (dependencies): Sibling package from the same ethereumjs monorepo, versioned in lockstep; expected co-dependency, not a third-party unknown.	ai	2026/04/25
dependencies	unvetted-dep:@ethereumjs/statemanager	AI (dependencies): Sibling package from the same ethereumjs monorepo, versioned in lockstep; expected co-dependency, not a third-party unknown.	ai	2026/04/25

Version	Deps	Published
10.1.2	8 / 16	2026-05-29
10.1.1	8 / 16	2026-01-28
10.1.0	8 / 16	2025-11-06
10.0.0	10 / 16	2025-04-29