@hashgraph/cryptography

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

steven.sheehyswirldslabs-adminrbair23nathan-swirldslabshedera-eng-automationnana-ec

Keywords

hierosdkhederahashgraphcryptography

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:elliptic	AI (dependencies): Standard well-known elliptic curve crypto library, widely used.	ai	2026/07/08
semgrep	semgrep:hex-decode	AI (semgrep): Cryptography library legitimately implements hex encode/decode utilities. Buffer.from(str, 'hex') is standard Node.js; no obfuscation or malicious payload hiding.	ai	2026/04/27
phantom-deps	phantom-dep:bn.js	AI (phantom-deps): Multi-target build (CJS/ESM/browser/react-native) may not directly import all declared deps in the analyzed entry point; stable false positive for this package.	ai	2026/04/27
phantom-deps	phantom-dep:debug	AI (phantom-deps): Multi-target build may not directly import all declared deps in the analyzed entry point; stable false positive for this package.	ai	2026/04/27
semgrep	semgrep:base64-decode	AI (semgrep): Cryptography library legitimately implements base64 encode/decode utilities. Buffer.from(text, 'base64') is standard Node.js; no obfuscation or malicious payload hiding.	ai	2026/04/27
phantom-deps	phantom-dep:ansi-regex	AI (phantom-deps): Multi-target build may not directly import all declared deps in the analyzed entry point; stable false positive for this package.	ai	2026/04/27
phantom-deps	phantom-dep:strip-ansi	AI (phantom-deps): Multi-target build may not directly import all declared deps in the analyzed entry point; stable false positive for this package.	ai	2026/04/27
phantom-deps	phantom-dep:ansi-styles	AI (phantom-deps): Multi-target build may not directly import all declared deps in the analyzed entry point; stable false positive for this package.	ai	2026/04/27
phantom-deps	phantom-dep:js-base64	AI (phantom-deps): Multi-target build may not directly import all declared deps in the analyzed entry point; stable false positive for this package.	ai	2026/04/27