← Home

@ledgerhq/coin-casper

npm Repository Homepage

Ledger Casper integration

45
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser

Keywords

LedgerLedgerWalletcsprCasperHardware Wallet

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): LedgerHQ CI pipeline publishes without Sigstore provenance; consistent across their package ecosystem. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding is used for standard blockchain transaction signing (signature and public key parsing). Expected pattern for a Casper blockchain integration library. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding in a utility function for message buffer conversion. Standard cryptographic data handling for a blockchain SDK integration. ai
phantom-deps phantom-dep:@ledgerhq/devices AI (phantom-deps): Same org scope (@ledgerhq); declared but not directly imported is a minor packaging concern, not a security issue. ai

Versions (showing 45 of 45)

Version Deps Published
2.16.0 11 / 13
2.15.0 13 / 14
2.14.0 13 / 14
2.13.7 13 / 14
2.13.6 13 / 14
2.13.5 13 / 14
2.13.4 13 / 14
2.13.3 13 / 14
2.13.2 13 / 14
2.13.1 13 / 14
2.13.0 13 / 14
2.12.0 13 / 14
2.11.1 13 / 12
2.11.0 13 / 12
2.10.0 12 / 12
2.9.0 12 / 12
2.8.5 12 / 11
2.8.4 12 / 11
2.8.3 12 / 11
2.8.2 12 / 11
2.8.1 12 / 11
2.8.0 12 / 11
2.7.0 12 / 11
2.6.0 12 / 10
2.5.1 12 / 10
2.5.0 12 / 10
2.4.2 12 / 10
2.4.1 12 / 10
2.4.0 12 / 10
2.3.0 12 / 10
2.2.0 12 / 10
2.1.3 12 / 10
2.1.2 12 / 10
2.1.1 12 / 10
2.1.0 12 / 10
2.0.9 12 / 10
2.0.8 12 / 10
2.0.7 12 / 10
2.0.6 12 / 10
2.0.5 12 / 10
2.0.4 12 / 10
2.0.3 12 / 10
2.0.2 12 / 10
2.0.1 12 / 10
2.0.0 12 / 10

v2.16.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.