@interchainjs/ethereum
Transaction codec and client to communicate with ethereum blockchain
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() is used in a standard Proxy trap pattern for dynamic contract property access — normal for an Ethereum contract encoding library, not obfuscation. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding via Buffer.from(hex, 'hex') is standard encoding utility code in an Ethereum library; no malicious payload present. | ai | |
| dependencies | unvetted-dep:ethereum-cryptography | AI (dependencies): ethereum-cryptography is a standard, widely-used Ethereum cryptography library; expected for this package's purpose. | ai | |
| dependencies | unvetted-dep:rlp | AI (dependencies): rlp is a well-known Ethereum RLP encoding library; expected dependency for an Ethereum transaction codec package. | ai | |
| dependencies | unvetted-dep:@interchainjs/auth | AI (dependencies): Sibling package from the same publisher (zetazz/Hyperweb) with a strong track record; expected internal dependency. | ai | |
| dependencies | unvetted-dep:@interchainjs/utils | AI (dependencies): Sibling package from the same publisher (zetazz/Hyperweb) with a strong track record; expected internal dependency. | ai | |
| dependencies | unvetted-dep:@ethersproject/transactions | AI (dependencies): Part of the well-known ethers.js v5 suite; expected dependency for an Ethereum transaction codec. | ai | |
| provenance | publisher-changed | AI (provenance): pyramation is the hyperweb-io/interchainjs monorepo maintainer with 2681 approved packages and 0 rejected. The transition from zetazz to pyramation reflects a legitimate organizational handoff within the same project. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @interchainjs/encoding is a sibling package in the same monorepo/namespace, published by the same maintainer. Intra-monorepo dependency additions are routine refactoring. | ai | |
| phantom-deps | phantom-dep:@noble/hashes | AI (phantom-deps): Declared in package.json for transitive/config use in a monorepo context; not a security concern for this Ethereum library. | ai | |
| phantom-deps | phantom-dep:@ethersproject/transactions | AI (phantom-deps): Ethersproject packages declared for config/transitive use; standard pattern in Ethereum libraries. | ai | |
| phantom-deps | phantom-dep:@ethersproject/bignumber | AI (phantom-deps): Ethersproject packages declared for config/transitive use; standard pattern in Ethereum libraries. | ai | |
| phantom-deps | phantom-dep:@ethersproject/bytes | AI (phantom-deps): Ethersproject packages declared for config/transitive use; standard pattern in Ethereum libraries. | ai | |
| phantom-deps | phantom-dep:@ethersproject/hash | AI (phantom-deps): Ethersproject packages declared for config/transitive use; standard pattern in Ethereum libraries. | ai |
Versions (showing 51 of 74)
| Version | Deps | Published |
|---|---|---|
| 1.21.0 | 14 / 8 | |
| 1.20.0 | 14 / 8 | |
| 1.19.2 | 13 / 8 | |
| 1.19.1 | 13 / 8 | |
| 1.19.0 | 13 / 8 | |
| 1.18.0 | 13 / 8 | |
| 1.17.8 | 13 / 8 | |
| 1.17.7 | 13 / 8 | |
| 1.17.6 | 13 / 8 | |
| 1.17.5 | 13 / 8 | |
| 1.17.4 | 13 / 7 | |
| 1.17.3 | 13 / 7 | |
| 1.17.2 | 13 / 7 | |
| 1.17.1 | 13 / 7 | |
| 1.17.0 | 13 / 7 | |
| 1.16.7 | 13 / 7 | |
| 1.16.6 | 13 / 7 | |
| 1.16.5 | 13 / 7 | |
| 1.16.4 | 13 / 7 | |
| 1.16.3 | 13 / 7 | |
| 1.16.2 | 13 / 7 | |
| 1.16.1 | 13 / 7 | |
| 1.16.0 | 13 / 7 | |
| 1.13.5 | 13 / 7 | |
| 1.13.0 | 12 / 6 | |
| 1.12.2 | 12 / 6 | |
| 1.12.1 | 12 / 6 | |
| 1.12.0 | 12 / 6 | |
| 1.11.18 | 9 / 2 | |
| 1.11.15 | 10 / 2 | |
| 1.11.14 | 10 / 2 | |
| 1.11.13 | 10 / 2 | |
| 1.11.12 | 10 / 2 | |
| 1.11.11 | 10 / 2 | |
| 1.11.10 | 10 / 2 | |
| 1.11.9 | 10 / 2 | |
| 1.11.8 | 10 / 2 | |
| 1.11.7 | 10 / 2 | |
| 1.11.6 | 10 / 2 | |
| 1.11.5 | 10 / 2 | |
| 1.11.4 | 10 / 2 | |
| 1.11.3 | 10 / 2 | |
| 1.11.2 | 10 / 2 | |
| 1.11.1 | 10 / 2 | |
| 1.11.0 | 10 / 2 | |
| 1.10.1 | 10 / 2 | |
| 1.10.0 | 10 / 2 | |
| 1.9.16 | 10 / 2 | |
| 1.9.15 | 10 / 0 | |
| 1.9.14 | 10 / 0 | |
| 1.9.13 | 10 / 0 |
v1.21.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-01. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-12-16. This could indicate a legitimate maintainer transition or an account compromise.
v1.19.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-12-11. This could indicate a legitimate maintainer transition or an account compromise.
v1.18.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.