@ledgerhq/hw-app-multiversx
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Declared dependency legitimately used in MultiversX app; phantom-dep false positive in monorepo context. | ai | |
| phantom-deps | phantom-dep:protobufjs | AI (phantom-deps): Declared dependency legitimately used in MultiversX app; phantom-dep false positive in monorepo context. | ai | |
| phantom-deps | phantom-dep:bignumber.js | AI (phantom-deps): Declared dependency legitimately used in MultiversX app; phantom-dep false positive in monorepo context. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding of cryptographic signature buffers is standard and expected in a hardware wallet signing library; not a malicious payload indicator. | ai | |
| dependencies | unvetted-dep:protobufjs | AI (dependencies): protobufjs is a widely-used legitimate serialization library; appropriate dependency for MultiversX blockchain transaction encoding. | ai | |
| dependencies | unvetted-dep:@multiversx/sdk-core | AI (dependencies): Official MultiversX blockchain SDK; appropriate dependency for a hardware wallet app targeting the MultiversX network. | ai |
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 6.30.6 | 6 / 10 | |
| 6.30.5 | 6 / 10 | |
| 6.30.4 | 6 / 10 | |
| 6.30.3 | 6 / 10 | |
| 6.30.2 | 6 / 10 | |
| 6.30.1 | 6 / 10 | |
| 6.30.0 | 6 / 10 | |
| 6.29.1 | 6 / 10 | |
| 6.29.0 | 6 / 10 | |
| 6.28.0 | 6 / 10 | |
| 6.27.0 | 6 / 10 | |
| 6.26.3 | 6 / 9 | |
| 6.26.2 | 6 / 9 | |
| 6.26.1 | 6 / 9 | |
| 6.26.0 | 6 / 9 | |
| 6.25.3 | 6 / 9 | |
| 6.25.2 | 6 / 9 | |
| 6.25.1 | 6 / 9 | |
| 6.25.0 | 6 / 9 | |
| 6.24.4 | 6 / 9 | |
| 6.24.3 | 6 / 9 | |
| 6.24.2 | 6 / 10 | |
| 6.24.1 | 6 / 10 | |
| 6.24.0 | 6 / 10 | |
| 6.23.0 | 6 / 10 | |
| 6.22.0 | 6 / 9 |
v6.30.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.24.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.