@layerzerolabs/lz-v2-stellar-sdk
TypeScript SDK for endpoint-v2 Stellar contract
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:src/generated/uln302.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:src/generated/executor_helper.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:src/generated/executor.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:src/generated/sml.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:dist/generated/bml.js | AI (source-diff): Base64-encoded Stellar contract XDR specs passed to ContractSpec constructor; standard Soroban SDK pattern. | ai | |
| source-diff | encoded-string-file:dist/generated/counter.js | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:dist/generated/endpoint.js | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:dist/generated/sml.js | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:dist/generated/uln302.js | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:src/generated/bml.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:src/generated/counter.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| source-diff | encoded-string-file:src/generated/endpoint.ts | AI (source-diff): Base64-encoded Stellar contract XDR specs; standard Soroban SDK generated client pattern. | ai | |
| phantom-deps | phantom-dep:@noble/hashes | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@noble/secp256k1 | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires on generated WASM buffer helpers that embed compiled Stellar contracts as base64; stable pattern for this SDK. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 0.2.84 | 4 / 7 | |
| 0.2.83 | 4 / 7 | |
| 0.2.82 | 4 / 7 | |
| 0.2.81 | 4 / 7 | |
| 0.2.80 | 4 / 7 | |
| 0.2.79 | 4 / 7 | |
| 0.2.78 | 4 / 7 | |
| 0.2.77 | 4 / 7 | |
| 0.2.76 | 4 / 7 | |
| 0.2.75 | 4 / 7 | |
| 0.2.74 | 4 / 7 | |
| 0.2.73 | 4 / 7 | |
| 0.2.72 | 4 / 7 | |
| 0.2.71 | 4 / 7 | |
| 0.2.70 | 4 / 7 | |
| 0.2.69 | 4 / 7 | |
| 0.2.68 | 4 / 7 | |
| 0.2.67 | 4 / 7 | |
| 0.2.66 | 4 / 7 | |
| 0.2.65 | 4 / 7 | |
| 0.2.64 | 4 / 7 | |
| 0.2.63 | 4 / 7 | |
| 0.2.62 | 4 / 9 | |
| 0.2.19 | 5 / 8 | |
| 0.2.15 | 2 / 9 | |
| 0.2.13 | 2 / 9 | |
| 0.2.12 | 2 / 9 | |
| 0.2.11 | 2 / 9 | |
| 0.2.10 | 2 / 9 | |
| 0.2.9 | 2 / 9 | |
| 0.2.8 | 2 / 9 |
v0.2.84
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.83
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.81
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.80
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.79
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.78
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.76
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.75
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.74
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.73
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.72
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.71
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.70
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.68
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.67
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.66
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.65
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.64
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.63
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.62
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.19
40 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 36 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 55 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 77 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 43 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 76 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 36 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 55 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 77 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 52 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 76 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 43 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 76 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.15
13 findingsModified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 41 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 67 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 33 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 66 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 41 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 67 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 44 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 67 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 33 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 66 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.13
13 findingsModified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 38 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 38 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 44 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.12
13 findingsModified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 38 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 38 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 44 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.11
13 findingsModified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 38 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 62 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 38 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 64 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 43 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 65 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 30 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 62 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.