@keplr-wallet/cosmos
51
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
chainapsis
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Scoped package from established org; missing description is common for internal library components. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is rare (~12% adoption); not a signal for this established publisher. | ai | |
| dependencies | unvetted-dep:protobufjs | AI (dependencies): protobufjs is a well-known, widely-used protobuf library; its use is expected and appropriate for a Cosmos blockchain client package handling protobuf serialization. | ai | |
| phantom-deps | phantom-dep:@keplr-wallet/common | AI (phantom-deps): Same-org scoped dependency in a monorepo; phantom import detection is unreliable for monorepo packages where usage may be indirect or in build artifacts. | ai | |
| provenance | publisher-changed | AI (provenance): Keplr wallet migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation; the publisher change reflects legitimate automation, not a compromise. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Missing metadata (description, repo, keywords) is typical for monorepo sub-packages; publisher chainapsis has 3057 approved packages and zero rejections. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding in this package is used for ADR-36 amino message validation in the Cosmos wallet context — standard cryptographic handling, not a malicious payload indicator. | ai | |
| phantom-deps | phantom-dep:long | AI (phantom-deps): 'long' is a standard dependency used alongside protobufjs for 64-bit integer handling; its indirect usage pattern is expected in protobuf-based packages. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding appears in a test spec file as a hardcoded Cosmos transaction fixture. This is normal test data for a Cosmos library, not obfuscated malicious code. | ai |
Versions (showing 51 of 452)
| Version | Deps | Published |
|---|---|---|
| 0.13.41 | 12 / 0 | |
| 0.13.40 | 12 / 0 | |
| 0.13.39 | 12 / 0 | |
| 0.13.38 | 12 / 0 | |
| 0.13.37 | 12 / 0 | |
| 0.13.36 | 12 / 0 | |
| 0.13.35 | 12 / 0 | |
| 0.13.34 | 12 / 0 | |
| 0.13.33 | 12 / 0 | |
| 0.13.32 | 12 / 0 | |
| 0.13.31 | 12 / 0 | |
| 0.13.30 | 12 / 0 | |
| 0.13.28 | 12 / 0 | |
| 0.13.27 | 12 / 0 | |
| 0.13.26 | 12 / 0 | |
| 0.13.24 | 12 / 0 | |
| 0.13.23 | 12 / 0 | |
| 0.13.22 | 12 / 0 | |
| 0.13.21 | 12 / 0 | |
| 0.13.20 | 12 / 0 | |
| 0.13.19 | 12 / 0 | |
| 0.13.18 | 12 / 0 | |
| 0.13.17 | 12 / 0 | |
| 0.13.16 | 12 / 0 | |
| 0.13.15 | 12 / 0 | |
| 0.13.14 | 12 / 0 | |
| 0.13.13 | 12 / 0 | |
| 0.13.12 | 12 / 0 | |
| 0.13.11 | 12 / 0 | |
| 0.13.10 | 12 / 0 | |
| 0.13.9 | 12 / 0 | |
| 0.13.8 | 12 / 0 | |
| 0.13.7 | 12 / 0 | |
| 0.13.6 | 12 / 0 | |
| 0.13.5 | 12 / 0 | |
| 0.13.4 | 12 / 0 | |
| 0.13.3 | 12 / 0 | |
| 0.13.2 | 12 / 0 | |
| 0.13.1 | 12 / 0 | |
| 0.13.0 | 12 / 0 | |
| 0.12.313 | 12 / 0 | |
| 0.12.312 | 12 / 0 | |
| 0.12.311 | 12 / 0 | |
| 0.12.310 | 12 / 0 | |
| 0.12.309 | 12 / 0 | |
| 0.12.308 | 12 / 0 | |
| 0.12.307 | 12 / 0 | |
| 0.12.306 | 12 / 0 | |
| 0.12.305 | 12 / 0 | |
| 0.12.304 | 12 / 0 | |
| 0.12.300 | 12 / 0 |
v0.13.41
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.40
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.