@ledgerhq/cryptoassets
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is first-party @ledgerhq/live-env from same monorepo. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are token/eip712 JSON data registries matching package purpose. | ai | |
| source-diff | encoded-string-file:lib/crypto-assets-importer/importers/trc10/trc10-tokens.js | AI (source-diff): Same TRC10 token data, duplicated in cjs build output. | ai | |
| source-diff | encoded-string-file:lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js | AI (source-diff): Hex-encoded TRC10 token metadata, not a payload; part of package's token-list data. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Ledger CI publisher with strong track record; routine release infra maintainer. | ai | |
| phantom-deps | phantom-dep:@ledgerhq/types-live | AI (phantom-deps): Same-org dependency declared for type compatibility; not a security concern for this package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in this package is standard blockchain address encoding (hex→base58check for TRC10 token addresses). Not a malicious payload pattern; stable false positive for this crypto-assets library. | ai | |
| semgrep | semgrep:shady-links-tlds | AI (semgrep): This package is a crypto-assets registry that legitimately contains blockchain explorer URLs with non-traditional TLDs (e.g., .xyz). These are data entries, not executable network calls. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@ledgerhq/types-live | AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. | ai | |
| dependencies | unvetted-dep:@ledgerhq/live-env | AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. | ai | |
| dependencies | unvetted-dep:@ledgerhq/errors | AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. | ai | |
| dependencies | unvetted-dep:@ledgerhq/logs | AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. | ai |
Versions (showing 51 of 67)
| Version | Deps | Published |
|---|---|---|
| 13.55.0 | 7 / 18 | |
| 13.54.0 | 7 / 18 | |
| 13.53.0 | 7 / 16 | |
| 13.52.0 | 8 / 16 | |
| 13.51.0 | 8 / 16 | |
| 13.50.0 | 8 / 16 | |
| 13.48.0 | 8 / 16 | |
| 13.47.0 | 8 / 16 | |
| 13.46.2 | 8 / 16 | |
| 13.46.1 | 8 / 16 | |
| 13.46.0 | 8 / 16 | |
| 13.45.0 | 8 / 16 | |
| 13.44.0 | 8 / 16 | |
| 13.43.0 | 8 / 16 | |
| 13.42.0 | 8 / 16 | |
| 13.41.0 | 8 / 16 | |
| 13.40.0 | 8 / 16 | |
| 13.39.1 | 8 / 16 | |
| 13.39.0 | 8 / 16 | |
| 13.38.1 | 7 / 16 | |
| 13.38.0 | 7 / 16 | |
| 13.37.1 | 7 / 16 | |
| 13.37.0 | 7 / 16 | |
| 13.36.0 | 7 / 14 | |
| 13.35.1 | 7 / 14 | |
| 13.35.0 | 7 / 14 | |
| 13.34.1 | 7 / 14 | |
| 13.34.0 | 7 / 14 | |
| 13.33.0 | 7 / 15 | |
| 13.32.0 | 7 / 15 | |
| 13.31.0 | 5 / 9 | |
| 13.30.0 | 4 / 10 | |
| 13.29.0 | 4 / 10 | |
| 13.28.0 | 4 / 10 | |
| 13.27.0 | 4 / 10 | |
| 13.26.0 | 4 / 10 | |
| 13.25.0 | 4 / 10 | |
| 13.24.0 | 4 / 10 | |
| 13.23.0 | 4 / 10 | |
| 13.22.0 | 4 / 10 | |
| 13.21.0 | 4 / 10 | |
| 13.20.0 | 4 / 10 | |
| 13.19.0 | 4 / 10 | |
| 13.18.1 | 4 / 10 | |
| 13.18.0 | 4 / 10 | |
| 13.17.0 | 4 / 10 | |
| 13.16.0 | 4 / 10 | |
| 13.15.0 | 4 / 10 | |
| 13.14.1 | 4 / 10 | |
| 13.14.0 | 4 / 10 | |
| 13.13.0 | 4 / 10 |
v13.55.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.54.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.53.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.14.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.14.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.