@ledgerhq/coin-tron
Ledger Tron Coin integration
38
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser
Keywords
LedgerLedgerWallettrxTronHardware Wallet
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:lib-es/network/index.integ.test.js | AI (source-diff): The long string is a Tron blockchain transaction ID used as a fixture key in integration tests — not an encoded payload. Stable false positive for this package. | ai | |
| source-diff | encoded-string-file:lib/network/index.integ.test.js | AI (source-diff): Same as lib-es counterpart: Tron transaction ID used as fixture key in integration test. Benign and stable for this package. | ai | |
| phantom-deps | phantom-dep:invariant | AI (phantom-deps): invariant is a utility used indirectly; phantom-dep false positive in monorepo structure. | ai | |
| phantom-deps | phantom-dep:expect | AI (phantom-deps): expect is a test dependency used in config/test contexts; phantom-dep false positive in monorepo structure. | ai | |
| phantom-deps | phantom-dep:@ledgerhq/devices | AI (phantom-deps): Internal Ledger dependency used indirectly; phantom-dep false positive in monorepo. | ai | |
| phantom-deps | phantom-dep:@ledgerhq/cryptoassets | AI (phantom-deps): Internal Ledger dependency used indirectly; phantom-dep false positive in monorepo. | ai | |
| provenance | no-provenance | AI (provenance): Large org CI publishing without Sigstore provenance is common; package metadata and repo URL are consistent with official LedgerHQ ecosystem. | ai | |
| semgrep | semgrep:shady-links-tlds | AI (semgrep): URLs appear in mock/test fixture data representing Tron super representatives. Not C2 infrastructure — test data for a blockchain coin module. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding of on-chain asset names is standard and expected behavior for a Tron blockchain integration library. Not a malicious payload indicator. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 6.6.0 | 15 / 14 | |
| 6.5.0 | 16 / 14 | |
| 6.4.0 | 16 / 14 | |
| 6.3.0 | 16 / 14 | |
| 6.2.0 | 16 / 14 | |
| 6.1.1 | 16 / 15 | |
| 6.1.0 | 16 / 15 | |
| 6.0.2 | 16 / 15 | |
| 6.0.1 | 16 / 15 | |
| 6.0.0 | 16 / 15 | |
| 5.19.0 | 16 / 15 | |
| 5.18.0 | 16 / 15 | |
| 5.17.1 | 17 / 13 | |
| 5.17.0 | 17 / 13 | |
| 5.16.0 | 16 / 13 | |
| 5.15.0 | 16 / 13 | |
| 5.14.0 | 16 / 12 | |
| 5.13.1 | 16 / 13 | |
| 5.13.0 | 16 / 13 | |
| 5.12.1 | 16 / 13 | |
| 5.12.0 | 16 / 13 | |
| 5.11.0 | 16 / 13 | |
| 5.10.0 | 16 / 13 | |
| 5.9.0 | 16 / 12 | |
| 5.8.1 | 16 / 12 | |
| 5.8.0 | 16 / 12 | |
| 5.7.2 | 16 / 12 | |
| 5.7.1 | 16 / 12 | |
| 5.7.0 | 16 / 12 | |
| 5.6.0 | 16 / 12 | |
| 5.5.0 | 16 / 12 | |
| 5.4.2 | 16 / 12 | |
| 5.4.1 | 16 / 12 | |
| 5.4.0 | 16 / 12 | |
| 5.3.0 | 16 / 12 | |
| 5.2.0 | 16 / 12 | |
| 5.1.0 | 16 / 12 | |
| 5.0.0 | 16 / 12 |
v6.6.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.5.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.