← Home

@ledgerhq/hw-app-eth

npm Repository Homepage
25
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser

Keywords

LedgerLedgerWalletethNanoSBlueHardware Wallet

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:tests/Eth.unit.test.ts AI (source-diff): Test fixtures with hex-encoded Ethereum transactions, APDU replay strings, and contract payloads — standard for a HW wallet ETH library. ai
source-diff encoded-string-file:tests/Uniswap/index.unit.test.ts AI (source-diff): Test fixtures with Uniswap calldata hex strings — expected for Ethereum transaction parsing tests. ai
source-diff encoded-string-file:tests/ledgerService.unit.test.ts AI (source-diff): Test fixtures with ERC20 signature blobs and serialized transaction data — standard for ledger service resolution tests. ai
phantom-deps phantom-dep:@ledgerhq/hw-transport-mocker AI (phantom-deps): Same-org test/mock utility from LedgerHQ monorepo; phantom dep finding is a false positive for this package's test infrastructure. ai
semgrep semgrep:hex-decode AI (semgrep): Hex encoding/decoding is standard for Ethereum transaction data (chainId buffers, address encoding). Not malicious in this hardware wallet library context. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding used to parse ERC20 signature blobs from Ledger's token service — standard data handling for this library. ai

Versions (showing 25 of 25)

Version Deps Published
7.8.5 13 / 13
7.8.4 13 / 13
7.8.3 13 / 13
7.8.2 13 / 13
7.8.1 13 / 13
7.8.0 13 / 13
7.7.0 13 / 13
7.6.2 13 / 13
7.6.1 13 / 13
7.6.0 13 / 13
7.5.0 13 / 13
7.4.2 13 / 13
7.4.1 13 / 13
7.4.0 13 / 13
7.3.3 13 / 13
7.3.2 13 / 13
7.3.1 13 / 13
7.3.0 13 / 13
7.2.0 13 / 12
7.1.1 13 / 12
7.1.0 13 / 12
7.0.1 13 / 12
7.0.0 13 / 12
6.47.1 14 / 12
6.47.0 14 / 12

v7.8.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.8.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.8.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.8.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.0

4 findings
HIGH Long encoded string in modified file: tests/Eth.unit.test.ts source-diff

Modified file contains 23 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: tests/Uniswap/index.unit.test.ts source-diff

Modified file contains 6 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: tests/ledgerService.unit.test.ts source-diff

Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.