← Home

@ledgerhq/coin-aptos

npm Repository Homepage

Ledger Aptos Coin integration

38
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser

Keywords

LedgerLedgerWalletaptAptosHardware Wallet

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:lib-es/__tests__/api/craftTransaction.unit.test.js AI (source-diff): Hex-encoded Aptos raw transaction used as test fixture; stable false positive for this package. ai
source-diff encoded-string-file:src/__tests__/api/craftTransaction.unit.test.ts AI (source-diff): Same hex test fixture in TypeScript source; stable false positive. ai
source-diff encoded-string-file:lib/__tests__/api/craftTransaction.unit.test.js AI (source-diff): Same hex test fixture in compiled CJS output; stable false positive. ai
dependencies unvetted-dep:@aptos-labs/ts-sdk AI (dependencies): @aptos-labs/ts-sdk is the official Aptos Labs TypeScript SDK — an expected and legitimate dependency for an Aptos blockchain integration package. ai
dependencies unvetted-dep:@ledgerhq/coin-framework AI (dependencies): @ledgerhq/coin-framework is an internal LedgerHQ package from the same organization; expected dependency for all LedgerHQ coin modules. ai
provenance no-provenance AI (provenance): LedgerHQ publishes via CI bot without Sigstore provenance; this is consistent across their monorepo releases and not a security concern for this package. ai
phantom-deps phantom-dep:got AI (phantom-deps): Declared but not directly imported; common in large monorepos where transitive deps are explicitly pinned. No security concern. ai
phantom-deps phantom-dep:invariant AI (phantom-deps): Declared but not directly imported; likely a monorepo artifact. No security concern. ai
phantom-deps phantom-dep:expect AI (phantom-deps): Declared but not directly imported; likely a monorepo artifact. No security concern. ai
phantom-deps phantom-dep:@ledgerhq/devices AI (phantom-deps): Same-org first-party package declared but not directly imported; consistent with monorepo dependency management. ai

Versions (showing 38 of 38)

Version Deps Published
3.23.0 18 / 14
3.22.0 19 / 14
3.21.0 19 / 14
3.20.3 19 / 14
3.20.2 19 / 14
3.20.1 19 / 14
3.20.0 19 / 14
3.19.0 19 / 14
3.18.2 19 / 15
3.18.1 19 / 15
3.18.0 19 / 15
3.17.0 19 / 15
3.16.1 20 / 13
3.16.0 20 / 13
3.15.0 19 / 13
3.14.0 19 / 13
3.13.0 19 / 12
3.12.1 19 / 12
3.12.0 19 / 12
3.11.2 19 / 12
3.11.1 19 / 12
3.11.0 19 / 12
3.10.0 19 / 12
3.9.0 19 / 11
3.8.1 19 / 11
3.8.0 19 / 11
3.7.1 19 / 11
3.7.0 19 / 11
3.6.0 19 / 11
3.5.0 19 / 11
3.4.0 19 / 11
3.3.2 19 / 11
3.3.1 19 / 11
3.3.0 19 / 11
3.2.0 19 / 11
3.1.1 19 / 11
3.1.0 19 / 11
3.0.0 19 / 11

v3.23.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.22.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.21.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.