← Home

@ledgerhq/device-management-kit

npm Repository

> [!CAUTION] > This is still under development and we are free to make new interfaces which may lead to Device Management Kit breaking changes.

15
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:lib/cjs/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.js AI (source-diff): Standard minified CJS build output for Ledger SDK; not obfuscated, readable logic using known deps. ai
source-diff obfuscated-file:lib/cjs/src/api/device-action/task/InstallLanguagePackageTask.test.js AI (source-diff): Bundled test file for InstallLanguagePackageTask; standard minified output, no malicious patterns. ai
source-diff obfuscated-file:lib/esm/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.test.js AI (source-diff): Bundled ESM test file; same pattern, no malicious content. ai
source-diff obfuscated-file:lib/cjs/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.test.js AI (source-diff): Bundled test file in minified form; contains only test assertions against the new feature. ai
source-diff obfuscated-file:lib/esm/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.js AI (source-diff): Standard minified ESM build output; same pattern as CJS counterpart, no malicious content. ai
source-diff obfuscated-file:lib/cjs/src/api/network/DmkNetworkClientHelpers.test.js AI (source-diff): Minified bundled test output; content is plainly readable unit tests. ai
source-diff obfuscated-file:lib/cjs/src/api/network/DmkNetworkClient.test.js AI (source-diff): Minified bundled test output; content is plainly readable unit tests, not obfuscated malware. ai
source-diff obfuscated-file:lib/esm/src/api/network/DmkNetworkClient.test.js AI (source-diff): Minified bundled test output; content is plainly readable unit tests, not obfuscated malware. ai
source-diff obfuscated-file:lib/esm/src/api/network/DmkNetworkClientHelpers.test.js AI (source-diff): Minified bundled test output; content is plainly readable unit tests. ai
source-diff obfuscated-file:lib/cjs/src/api/command/os/GetAppStorageInfoCommand.test.js AI (source-diff): Minified bundled test output; content is plainly readable unit tests. ai
source-diff obfuscated-file:lib/esm/src/api/command/os/GetAppStorageInfoCommand.test.js AI (source-diff): Minified bundled test output; content is plainly readable unit tests. ai
source-diff obfuscated-file:lib/cjs/src/internal/manager-api/data/HttpManagerApiDataSource.js AI (source-diff): Minified CJS bundle; content is readable API client code replacing axios with DmkNetworkClient. ai
source-diff obfuscated-file:lib/esm/src/internal/manager-api/data/HttpManagerApiDataSource.js AI (source-diff): Minified ESM bundle; content is readable API client code replacing axios with DmkNetworkClient. ai
source-diff obfuscated-file:lib/cjs/src/internal/manager-api/data/HttpManagerApiDataSource.test.js AI (source-diff): Minified bundled test output; consistent with package's build pattern. ai
source-diff obfuscated-file:lib/esm/src/internal/manager-api/data/HttpManagerApiDataSource.test.js AI (source-diff): Minified bundled test output; consistent with package's build pattern. ai
source-diff obfuscated-file:lib/esm/src/internal/device-session/model/DeviceSession.test.js AI (source-diff): Minified test file bundled into ESM output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. ai
source-diff obfuscated-file:lib/esm/src/internal/device-session/service/IntentQueueService.test.js AI (source-diff): Minified test file bundled into ESM output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. ai
source-diff obfuscated-file:lib/cjs/src/internal/device-session/service/IntentQueueService.test.js AI (source-diff): Minified test file bundled into CJS output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. ai
source-diff obfuscated-file:lib/cjs/src/internal/device-session/model/DeviceSession.test.js AI (source-diff): Minified test file bundled into CJS output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. ai
source-diff obfuscated-file:lib/cjs/src/internal/logger-publisher/service/sanitiseData.test.js AI (source-diff): File is a minified test bundle for a BigInt sanitization utility — content is fully readable and benign. Minified test output is expected in this package's build pipeline. ai
publish-pattern new-deps-added AI (publish-pattern): @noble/hashes is a reputable cryptographic library by paulmillr; its addition to a hardware wallet SDK is expected and benign. ai
provenance publisher-changed AI (provenance): ledger-releaser is a Ledger org CI/CD account (26 approved, 0 rejected); transition from ldg-github-ci is a legitimate internal tooling migration for this package. ai
phantom-deps phantom-dep:ws AI (phantom-deps): ws is declared in dependencies and used indirectly via isomorphic-ws; phantom detection is a false positive for this indirect usage pattern. ai
phantom-deps phantom-dep:@sentry/minimal AI (phantom-deps): Declared in dependencies; conditional/indirect usage in a large SDK is expected. No malicious signal. ai
semgrep semgrep:base64-decode AI (semgrep): Base64String.js is a named utility class in a hardware wallet SDK; base64 handling is expected. Minified CJS build artifact, no suspicious network or exfiltration patterns. ai
dependencies unvetted-dep:purify-ts AI (dependencies): purify-ts is a well-known functional programming library (Maybe/Either monads); legitimate and pinned dependency for a typed SDK. ai

Versions (showing 15 of 15)

Version Deps Published
1.5.1 11 / 11
1.5.0 11 / 11
1.4.1 11 / 11
1.4.0 11 / 11
1.3.0 11 / 11
1.2.0 12 / 11
1.1.0 12 / 11
1.0.1 12 / 11
1.0.0 12 / 11
0.13.0 12 / 11
0.12.0 12 / 11
0.11.2 12 / 11
0.11.1 11 / 11
0.11.0 11 / 11
0.10.0 11 / 11

v1.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.4.0

6 findings
HIGH New obfuscated file: lib/cjs/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cjs/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cjs/src/api/device-action/task/InstallLanguagePackageTask.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.1.0

7 findings
HIGH Publisher changed: ldg-github-ci → ledger-releaser (on 2026-02-12) provenance

This version was published by a different npm account than previous versions on 2026-02-12. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: lib/cjs/src/internal/device-session/model/DeviceSession.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/src/internal/device-session/model/DeviceSession.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cjs/src/internal/device-session/service/IntentQueueService.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/src/internal/device-session/service/IntentQueueService.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cjs/src/internal/logger-publisher/service/sanitiseData.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.0.1

3 findings
HIGH Publisher changed: ldg-github-ci → ledger-releaser (on 2026-01-26) provenance

This version was published by a different npm account than previous versions on 2026-01-26. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: lib/cjs/src/internal/logger-publisher/service/sanitiseData.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v1.0.0

2 findings
HIGH Publisher changed: ldg-github-ci → ledger-releaser (on 2026-01-09) provenance

This version was published by a different npm account than previous versions on 2026-01-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.13.0

2 findings
HIGH Publisher changed: ldg-github-ci → ledger-releaser (on 2025-12-12) provenance

This version was published by a different npm account than previous versions on 2025-12-12. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.12.0

2 findings
HIGH Publisher changed: ldg-github-ci → ledger-releaser (on 2025-12-09) provenance

This version was published by a different npm account than previous versions on 2025-12-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.11.2

2 findings
HIGH Publisher changed: ldg-github-ci → ledger-releaser (on 2025-11-28) provenance

This version was published by a different npm account than previous versions on 2025-11-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.