← Home

@ledgerhq/cryptoassets

npm Repository Homepage
68
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser

Keywords

Ledger

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): Added dep is first-party @ledgerhq/live-env from same monorepo. ai
source-diff large-new-source-files AI (source-diff): New files are token/eip712 JSON data registries matching package purpose. ai
source-diff encoded-string-file:lib/crypto-assets-importer/importers/trc10/trc10-tokens.js AI (source-diff): Same TRC10 token data, duplicated in cjs build output. ai
source-diff encoded-string-file:lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js AI (source-diff): Hex-encoded TRC10 token metadata, not a payload; part of package's token-list data. ai
maintainer-change maintainer-added AI (maintainer-change): Ledger CI publisher with strong track record; routine release infra maintainer. ai
phantom-deps phantom-dep:@ledgerhq/types-live AI (phantom-deps): Same-org dependency declared for type compatibility; not a security concern for this package. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding in this package is standard blockchain address encoding (hex→base58check for TRC10 token addresses). Not a malicious payload pattern; stable false positive for this crypto-assets library. ai
semgrep semgrep:shady-links-tlds AI (semgrep): This package is a crypto-assets registry that legitimately contains blockchain explorer URLs with non-traditional TLDs (e.g., .xyz). These are data entries, not executable network calls. Stable false positive for this package. ai
dependencies unvetted-dep:@ledgerhq/types-live AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. ai
dependencies unvetted-dep:@ledgerhq/live-env AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. ai
dependencies unvetted-dep:@ledgerhq/errors AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. ai
dependencies unvetted-dep:@ledgerhq/logs AI (dependencies): First-party @ledgerhq/* dependency from the same LedgerHQ monorepo. Not a third-party unknown. ai

Versions (showing 68 of 68)

Version Deps Published
13.56.0 7 / 18
13.55.0 7 / 18
13.54.0 7 / 18
13.53.0 7 / 16
13.52.0 8 / 16
13.51.0 8 / 16
13.50.0 8 / 16
13.48.0 8 / 16
13.47.0 8 / 16
13.46.2 8 / 16
13.46.1 8 / 16
13.46.0 8 / 16
13.45.0 8 / 16
13.44.0 8 / 16
13.43.0 8 / 16
13.42.0 8 / 16
13.41.0 8 / 16
13.40.0 8 / 16
13.39.1 8 / 16
13.39.0 8 / 16
13.38.1 7 / 16
13.38.0 7 / 16
13.37.1 7 / 16
13.37.0 7 / 16
13.36.0 7 / 14
13.35.1 7 / 14
13.35.0 7 / 14
13.34.1 7 / 14
13.34.0 7 / 14
13.33.0 7 / 15
13.32.0 7 / 15
13.31.0 5 / 9
13.30.0 4 / 10
13.29.0 4 / 10
13.28.0 4 / 10
13.27.0 4 / 10
13.26.0 4 / 10
13.25.0 4 / 10
13.24.0 4 / 10
13.23.0 4 / 10
13.22.0 4 / 10
13.21.0 4 / 10
13.20.0 4 / 10
13.19.0 4 / 10
13.18.1 4 / 10
13.18.0 4 / 10
13.17.0 4 / 10
13.16.0 4 / 10
13.15.0 4 / 10
13.14.1 4 / 10
13.14.0 4 / 10
13.13.0 4 / 10
13.12.0 4 / 10
13.11.0 4 / 10
13.10.0 4 / 10
13.9.0 4 / 10
13.8.0 4 / 10
13.7.0 4 / 10
13.6.2 4 / 10
13.6.1 4 / 10
13.6.0 4 / 10
13.5.0 4 / 10
13.4.0 3 / 10
13.3.0 3 / 10
13.2.0 3 / 10
13.1.1 3 / 10
13.1.0 3 / 10
13.0.0 3 / 10

v13.56.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.55.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.54.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.53.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.14.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v13.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.4.0

3 findings
HIGH Long encoded string in modified file: lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: lib/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.3.0

3 findings
HIGH Long encoded string in modified file: lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: lib/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.0

3 findings
HIGH Long encoded string in modified file: lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: lib/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.1

3 findings
HIGH Long encoded string in modified file: lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: lib/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.0

3 findings
HIGH Long encoded string in modified file: lib-es/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: lib/crypto-assets-importer/importers/trc10/trc10-tokens.js source-diff

Modified file contains 37 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.