@layerzerolabs/onesig-stellar-sdk
TypeScript SDK for OneSig Stellar contract
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@layerzerolabs/onesig-model | AI (dependencies): First-party LayerZero monorepo sibling package, version-locked. | ai | |
| source-diff | obfuscated-file:dist/CKS652UM.mjs | AI (source-diff): Long line is base64 WASM contract bytecode from Stellar codegen, not JS obfuscation. | ai | |
| source-diff | obfuscated-file:dist/UYXK2UEL.js | AI (source-diff): Long lines are base64-encoded WASM binary embedded in tsup bundle output; stable pattern for this SDK package. | ai | |
| source-diff | obfuscated-file:dist/3HKBGYOL.mjs | AI (source-diff): Same WASM_BASE64 pattern in ESM bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/HGRTSKEP.js | AI (source-diff): Long lines are base64-encoded WASM binary embedded in tsup bundle; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/DRHBZO6J.mjs | AI (source-diff): Same WASM_BASE64 pattern in ESM bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/5T7UM34D.js | AI (source-diff): Long lines are base64-encoded WASM binary embedded in tsup bundle; expected pattern for this Stellar SDK package. | ai | |
| source-diff | obfuscated-file:dist/LLFTVQ4V.mjs | AI (source-diff): Same WASM_BASE64 pattern in ESM bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/TMJBDWPO.mjs | AI (source-diff): Same WASM_BASE64 pattern in ESM bundle; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/YMEC3WUG.js | AI (source-diff): Long lines are base64-encoded WASM binary in a tsup bundle; standard pattern for this SDK. | ai | |
| source-diff | encoded-string-file:dist/generated/index.d.ts | AI (source-diff): Base64 string is documented WASM bytecode for Stellar contract SDK; stable pattern for this package. | ai | |
| provenance | no-provenance | AI (provenance): LayerZero bot publisher; no provenance is consistent across their published packages and not a risk signal here. | ai |
Versions (showing 51 of 80)
| Version | Deps | Published |
|---|---|---|
| 0.2.121 | 4 / 11 | |
| 0.2.120 | 4 / 11 | |
| 0.2.119 | 4 / 11 | |
| 0.2.118 | 4 / 11 | |
| 0.2.117 | 4 / 11 | |
| 0.2.116 | 4 / 11 | |
| 0.2.115 | 4 / 11 | |
| 0.2.114 | 4 / 11 | |
| 0.2.113 | 3 / 11 | |
| 0.2.112 | 3 / 11 | |
| 0.2.111 | 3 / 11 | |
| 0.2.110 | 2 / 9 | |
| 0.2.109 | 2 / 9 | |
| 0.2.108 | 2 / 9 | |
| 0.2.107 | 2 / 9 | |
| 0.2.106 | 2 / 9 | |
| 0.2.105 | 2 / 9 | |
| 0.2.104 | 2 / 9 | |
| 0.2.103 | 2 / 9 | |
| 0.2.102 | 2 / 9 | |
| 0.2.101 | 2 / 9 | |
| 0.2.100 | 2 / 9 | |
| 0.2.99 | 2 / 9 | |
| 0.2.98 | 2 / 9 | |
| 0.2.97 | 2 / 9 | |
| 0.2.96 | 2 / 9 | |
| 0.2.95 | 2 / 9 | |
| 0.2.94 | 2 / 9 | |
| 0.2.93 | 2 / 9 | |
| 0.2.92 | 2 / 9 | |
| 0.2.91 | 2 / 9 | |
| 0.2.90 | 2 / 9 | |
| 0.2.89 | 2 / 9 | |
| 0.2.88 | 2 / 9 | |
| 0.2.87 | 2 / 9 | |
| 0.2.86 | 2 / 9 | |
| 0.2.85 | 2 / 9 | |
| 0.2.84 | 2 / 9 | |
| 0.2.83 | 2 / 9 | |
| 0.2.82 | 2 / 9 | |
| 0.2.81 | 2 / 9 | |
| 0.2.80 | 2 / 9 | |
| 0.2.79 | 2 / 9 | |
| 0.2.78 | 2 / 9 | |
| 0.2.77 | 2 / 9 | |
| 0.2.76 | 2 / 9 | |
| 0.2.75 | 2 / 9 | |
| 0.2.74 | 2 / 9 | |
| 0.2.73 | 2 / 9 | |
| 0.2.72 | 2 / 9 | |
| 0.2.71 | 2 / 9 |
v0.2.121
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.120
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.119
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.118
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.117
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.116
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.115
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.114
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.113
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.112
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.111
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.110
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.109
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.