@ledgerhq/device-management-kit
> [!CAUTION] > This is still under development and we are free to make new interfaces which may lead to Device Management Kit breaking changes.
15
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/cjs/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.js | AI (source-diff): Standard minified CJS build output for Ledger SDK; not obfuscated, readable logic using known deps. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/api/device-action/task/InstallLanguagePackageTask.test.js | AI (source-diff): Bundled test file for InstallLanguagePackageTask; standard minified output, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lib/esm/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.test.js | AI (source-diff): Bundled ESM test file; same pattern, no malicious content. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.test.js | AI (source-diff): Bundled test file in minified form; contains only test assertions against the new feature. | ai | |
| source-diff | obfuscated-file:lib/esm/src/api/device-action/os/InstallLanguagePackage/InstallLanguagePackageDeviceAction.js | AI (source-diff): Standard minified ESM build output; same pattern as CJS counterpart, no malicious content. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/api/network/DmkNetworkClientHelpers.test.js | AI (source-diff): Minified bundled test output; content is plainly readable unit tests. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/api/network/DmkNetworkClient.test.js | AI (source-diff): Minified bundled test output; content is plainly readable unit tests, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:lib/esm/src/api/network/DmkNetworkClient.test.js | AI (source-diff): Minified bundled test output; content is plainly readable unit tests, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:lib/esm/src/api/network/DmkNetworkClientHelpers.test.js | AI (source-diff): Minified bundled test output; content is plainly readable unit tests. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/api/command/os/GetAppStorageInfoCommand.test.js | AI (source-diff): Minified bundled test output; content is plainly readable unit tests. | ai | |
| source-diff | obfuscated-file:lib/esm/src/api/command/os/GetAppStorageInfoCommand.test.js | AI (source-diff): Minified bundled test output; content is plainly readable unit tests. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/internal/manager-api/data/HttpManagerApiDataSource.js | AI (source-diff): Minified CJS bundle; content is readable API client code replacing axios with DmkNetworkClient. | ai | |
| source-diff | obfuscated-file:lib/esm/src/internal/manager-api/data/HttpManagerApiDataSource.js | AI (source-diff): Minified ESM bundle; content is readable API client code replacing axios with DmkNetworkClient. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/internal/manager-api/data/HttpManagerApiDataSource.test.js | AI (source-diff): Minified bundled test output; consistent with package's build pattern. | ai | |
| source-diff | obfuscated-file:lib/esm/src/internal/manager-api/data/HttpManagerApiDataSource.test.js | AI (source-diff): Minified bundled test output; consistent with package's build pattern. | ai | |
| source-diff | obfuscated-file:lib/esm/src/internal/device-session/model/DeviceSession.test.js | AI (source-diff): Minified test file bundled into ESM output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. | ai | |
| source-diff | obfuscated-file:lib/esm/src/internal/device-session/service/IntentQueueService.test.js | AI (source-diff): Minified test file bundled into ESM output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/internal/device-session/service/IntentQueueService.test.js | AI (source-diff): Minified test file bundled into CJS output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/internal/device-session/model/DeviceSession.test.js | AI (source-diff): Minified test file bundled into CJS output by build tooling. Content is standard vitest unit tests with no malicious behavior. Pattern is stable for this package's build process. | ai | |
| source-diff | obfuscated-file:lib/cjs/src/internal/logger-publisher/service/sanitiseData.test.js | AI (source-diff): File is a minified test bundle for a BigInt sanitization utility — content is fully readable and benign. Minified test output is expected in this package's build pipeline. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @noble/hashes is a reputable cryptographic library by paulmillr; its addition to a hardware wallet SDK is expected and benign. | ai | |
| provenance | publisher-changed | AI (provenance): ledger-releaser is a Ledger org CI/CD account (26 approved, 0 rejected); transition from ldg-github-ci is a legitimate internal tooling migration for this package. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is declared in dependencies and used indirectly via isomorphic-ws; phantom detection is a false positive for this indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@sentry/minimal | AI (phantom-deps): Declared in dependencies; conditional/indirect usage in a large SDK is expected. No malicious signal. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64String.js is a named utility class in a hardware wallet SDK; base64 handling is expected. Minified CJS build artifact, no suspicious network or exfiltration patterns. | ai | |
| dependencies | unvetted-dep:purify-ts | AI (dependencies): purify-ts is a well-known functional programming library (Maybe/Either monads); legitimate and pinned dependency for a typed SDK. | ai |