@hyperlane-xyz/sdk
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Package published via CI/CD with SLSA provenance; maintainer addition is a routine org change for this monorepo. | ai | |
| dependencies | unvetted-dep:starknet | AI (dependencies): Legitimate StarkNet integration dependency for a multi-chain SDK; stable pattern across versions. | ai | |
| dependencies | unvetted-dep:@hyperlane-xyz/core | AI (dependencies): First-party monorepo sibling package; expected dependency for this SDK. | ai | |
| provenance | slsa-provenance | AI (provenance): Hyperlane monorepo consistently publishes with SLSA provenance; stable signal across versions. | ai | |
| phantom-deps | phantom-dep:@cosmjs/crypto | AI (phantom-deps): CosmJS deps are declared and used transitively; phantom-dep heuristic false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:@cosmjs/tendermint-rpc | AI (phantom-deps): Same as above — CosmJS tendermint-rpc is a legitimate declared dep used via config/type references. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 34.0.0 | 41 / 24 | |
| 33.1.0 | 41 / 24 | |
| 33.0.2 | 41 / 24 | |
| 32.0.1 | 41 / 24 | |
| 31.2.1 | 41 / 24 | |
| 31.1.0 | 41 / 24 | |
| 31.0.1 | 41 / 24 | |
| 31.0.0 | 41 / 24 | |
| 30.1.1 | 41 / 24 | |
| 30.1.0 | 41 / 24 |
v34.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v33.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v33.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v32.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v31.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v31.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v31.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v31.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.