@ledgerhq/coin-filecoin
Ledger Filecoin Coin integration
9
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser
Keywords
LedgerLedgerWalletfilFilecoinHardware Wallet
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Provenance attestation is not yet standard practice; absence is not a security concern for this established, ecosystem-trusted package. | ai | |
| dependencies | unvetted-dep:@zondax/cbor | AI (dependencies): Zondax is a known blockchain tooling company working with Ledger; @zondax/cbor is a domain-appropriate CBOR library for Filecoin integration. | ai | |
| dependencies | unvetted-dep:iso-filecoin | AI (dependencies): iso-filecoin is a standard Filecoin utility library; appropriate dependency for a Filecoin coin integration package. | ai | |
| phantom-deps | phantom-dep:@ledgerhq/devices | AI (phantom-deps): Same-org package declared as dependency in a large monorepo; phantom dep finding is a false positive for this package structure. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): hex-decode fires on a legitimate getBufferFromString utility in a blockchain library; decoding hex/base64 transaction data is expected behavior for a Filecoin coin integration. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): base64-decode fires on the same getBufferFromString utility; decoding base64 message data is standard for a blockchain/crypto library, not a malicious payload. | ai |