@ledgerhq/device-trusted-app-kit-ledger-keyring-protocol
...
6
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:lib/cjs/internal/app-binder/task/SignChallengeWithKeypairTask.test.js | AI (source-diff): Long strings are hex-encoded cryptographic test vectors (ECDSA signatures, TLV challenge data, private keys) used as hardcoded fixtures in unit tests. Stable false positive for this crypto signing library. | ai | |
| source-diff | encoded-string-file:lib/esm/internal/app-binder/task/SignChallengeWithKeypairTask.test.js | AI (source-diff): Same as CJS counterpart — hex-encoded cryptographic test vectors in unit test fixtures. Stable false positive for this crypto signing library. | ai | |
| dependencies | unvetted-dep:purify-ts | AI (dependencies): purify-ts is a well-known functional programming library for TypeScript with no known advisories; its use here is legitimate and expected. | ai | |
| dependencies | unvetted-peer-dep:@ledgerhq/device-management-kit | AI (dependencies): First-party Ledger peer dependency; entirely expected within the LedgerHQ device SDK ecosystem. | ai |