@inco/js
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:bincode-ts | AI (dependencies): bincode-ts is a serialization utility; no malware indicators and its use is consistent with this FHE SDK's needs. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/preflight/v1/query_pb.js | AI (source-diff): Protobuf fileDesc() base64 descriptor — standard protoc-gen-es output. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/preflight/v1/types_pb.js | AI (source-diff): Protobuf fileDesc() base64 descriptor — standard protoc-gen-es output. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/preflight/v1/tx_pb.js | AI (source-diff): Protobuf fileDesc() base64 descriptor — standard protoc-gen-es output. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/fhe/v1/types_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/fhe/v1/tx_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/fhe/v1/query_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/fhe/v1/genesis_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/fhe/v1/events_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/google/api/http_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/google/api/annotations_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/cosmos_proto/cosmos_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/cosmos/ics23/v1/proofs_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/generated/es/cosmos/msg/v1/msg_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/preflight/v1/genesis_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/kms/lite/v1/types_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | encoded-string-file:dist/generated/es/inco/kms/lite/v1/kms_service_pb.js | AI (source-diff): Protobuf file descriptor encoded string generated by protoc-gen-es. | ai | |
| source-diff | obfuscated-file:dist/cjs/generated/abis/test-elist.js | AI (source-diff): Generated ABI file from wagmi CLI; long lines are concatenated ABI entries, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/esm/generated/abis/test-elist.js | AI (source-diff): Generated ABI file from wagmi CLI; long lines are concatenated ABI entries, not obfuscation. | ai | |
| phantom-deps | phantom-dep:@cosmjs/tendermint-rpc | AI (phantom-deps): Referenced in config/proto generation context; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@wagmi/cli | AI (phantom-deps): Used as a build/codegen tool via 'wagmi generate'; not a runtime import by design. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established package with 127 versions; missing description is stable pattern, not malware signal. | ai | |
| provenance | no-provenance | AI (provenance): Provenance is a best-practice recommendation, not a blocker for established packages. | ai | |
| source-diff | obfuscated-file:dist/esm/kms/quorumClient.js | AI (source-diff): ESM equivalent of the same compiled TypeScript; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/kms/quorumClient.js | AI (source-diff): Readable TypeScript-compiled output; long lines from bundled class methods, not obfuscation. | ai | |
| source-diff | encoded-string-file:dist/cjs/generated/es/inco/covalidator/compute/v1/server_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/esm/generated/es/inco/kms/lite/v1/types_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/esm/generated/es/inco/kms/lite/v1/kms_service_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/esm/generated/es/inco/covalidator/compute/v1/types_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/esm/generated/es/inco/covalidator/compute/v1/server_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/cjs/generated/es/inco/kms/lite/v1/types_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/cjs/generated/es/inco/kms/lite/v1/kms_service_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/cjs/generated/es/inco/covalidator/compute/v1/types_pb.js | AI (source-diff): Base64 protobuf file descriptor in protoc-gen-es generated code; stable pattern for this package. | ai | |
| dependencies | unvetted-dep:ecies-geth | AI (dependencies): ECIES encryption library appropriate for Ethereum/FHE context; stable use across versions. | ai | |
| dependencies | unvetted-dep:elliptic | AI (dependencies): Standard elliptic-curve crypto library; expected dependency for an FHE/encryption SDK. | ai | |
| typosquat | typosquat.levenshtein:jest | AI (typosquat): Scoped package with legitimate purpose; 2-edit distance to jest is not meaningful. | ai | |
| phantom-deps | phantom-dep:@connectrpc/connect-node | AI (phantom-deps): ConnectRPC node transport; referenced in config, legitimate for this SDK. | ai | |
| phantom-deps | phantom-dep:@types/elliptic | AI (phantom-deps): Type-only package; framework-scoped, not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:@grpc/grpc-js | AI (phantom-deps): gRPC transport dep referenced in config; expected for ConnectRPC node transport. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped package with legitimate purpose; 2-edit distance to ajv is not meaningful. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package with legitimate purpose; 2-edit distance to joi is not meaningful. | ai | |
| typosquat | typosquat.levenshtein:rxjs | AI (typosquat): Scoped package with legitimate purpose; 2-edit distance to rxjs is not meaningful. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package with legitimate purpose; 2-edit distance to pg is not meaningful. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): @inco/js is a scoped FHE SDK package, not a typosquat of qs; name collision is coincidental. | ai |
Versions (showing 35 of 35)
| Version | Deps | Published |
|---|---|---|
| 0.7.12 | 11 / 10 | |
| 0.7.11 | 11 / 10 | |
| 0.7.10 | 11 / 10 | |
| 0.7.9 | 11 / 10 | |
| 0.7.8 | 11 / 10 | |
| 0.7.7 | 11 / 10 | |
| 0.7.6 | 11 / 10 | |
| 0.7.5 | 11 / 10 | |
| 0.7.4 | 11 / 10 | |
| 0.7.3 | 11 / 10 | |
| 0.7.2 | 11 / 10 | |
| 0.7.1 | 11 / 10 | |
| 0.7.0 | 11 / 10 | |
| 0.6.9 | 11 / 10 | |
| 0.6.1 | 10 / 9 | |
| 0.6.0 | 10 / 9 | |
| 0.5.3 | 10 / 9 | |
| 0.5.2 | 10 / 9 | |
| 0.5.1 | 10 / 9 | |
| 0.5.0 | 10 / 9 | |
| 0.4.0 | 10 / 11 | |
| 0.2.16 | 15 / 12 | |
| 0.2.14 | 15 / 12 | |
| 0.2.13 | 15 / 12 | |
| 0.2.12 | 15 / 12 | |
| 0.2.11 | 15 / 12 | |
| 0.2.10 | 15 / 12 | |
| 0.2.7 | 15 / 12 | |
| 0.2.6 | 15 / 12 | |
| 0.2.5 | 15 / 12 | |
| 0.2.4 | 15 / 12 | |
| 0.1.40 | 15 / 10 | |
| 0.1.36 | 15 / 10 | |
| 0.1.35 | 15 / 10 | |
| 0.1.34 | 15 / 10 |
v0.7.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.9
9 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.8
9 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.1
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.4
14 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.36
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.35
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.34
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.