@ledgerhq/hw-transport-node-hid-noevents
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Long-stable LedgerHQ org publish; new maintainers are Ledger team accounts. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Old, stable transition (2022), not a recent takeover. | ai | |
| provenance | publisher-changed-stale | AI (provenance): Publisher change is stale (1457d), consistent with legitimate org handoff not compromise. | ai |
Versions (showing 51 of 70)
| Version | Deps | Published |
|---|---|---|
| 6.36.0 | 5 / 10 | |
| 6.35.4 | 5 / 10 | |
| 6.35.3 | 5 / 10 | |
| 6.35.2 | 5 / 10 | |
| 6.35.1 | 5 / 10 | |
| 6.35.0 | 5 / 10 | |
| 6.34.0 | 5 / 10 | |
| 6.33.0 | 5 / 10 | |
| 6.32.0 | 5 / 10 | |
| 6.31.0 | 5 / 10 | |
| 6.30.17 | 5 / 9 | |
| 6.30.16 | 5 / 9 | |
| 6.30.15 | 5 / 9 | |
| 6.30.14 | 5 / 9 | |
| 6.30.13 | 5 / 9 | |
| 6.30.12 | 5 / 9 | |
| 6.30.11 | 5 / 9 | |
| 6.30.10 | 5 / 9 | |
| 6.30.9 | 5 / 9 | |
| 6.30.8 | 5 / 9 | |
| 6.30.7 | 5 / 9 | |
| 6.30.6 | 5 / 9 | |
| 6.30.5 | 5 / 9 | |
| 6.30.4 | 5 / 9 | |
| 6.30.3 | 5 / 9 | |
| 6.30.2 | 5 / 9 | |
| 6.30.1 | 5 / 9 | |
| 6.30.0 | 5 / 9 | |
| 6.29.6 | 5 / 9 | |
| 6.29.5 | 5 / 9 | |
| 6.29.4 | 5 / 9 | |
| 6.29.3 | 5 / 9 | |
| 6.29.2 | 5 / 9 | |
| 6.29.1 | 5 / 9 | |
| 6.29.0 | 5 / 9 | |
| 6.28.0 | 5 / 9 | |
| 6.27.19 | 5 / 9 | |
| 6.27.18 | 5 / 9 | |
| 6.27.17 | 5 / 9 | |
| 6.27.16 | 5 / 9 | |
| 6.27.15 | 5 / 9 | |
| 6.27.14 | 5 / 9 | |
| 6.27.13 | 5 / 10 | |
| 6.27.12 | 5 / 1 | |
| 6.27.11 | 5 / 1 | |
| 6.27.10 | 5 / 1 | |
| 6.27.9 | 5 / 1 | |
| 6.27.8 | 5 / 1 | |
| 6.27.7 | 5 / 1 | |
| 6.27.6 | 5 / 1 | |
| 6.27.5 | 5 / 1 |
v6.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.30.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.29.6
2 findingsThis version was published by a different npm account (ldg-github-ci) than the most recent previously approved version (juan-cortes) on 2024-04-18. It has since remained available on npm for 827 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.29.5
2 findingsThis version was published by a different npm account (ldg-github-ci) than the most recent previously approved version (juan-cortes) on 2024-03-19. It has since remained available on npm for 857 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.29.4
2 findingsThis version was published by a different npm account (ldg-github-ci) than the most recent previously approved version (juan-cortes) on 2024-02-19. It has since remained available on npm for 886 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.29.3
2 findingsThis version was published by a different npm account (ldg-github-ci) than the most recent previously approved version (juan-cortes) on 2024-01-31. It has since remained available on npm for 905 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.29.2
2 findingsThis version was published by a different npm account (ldg-github-ci) than the most recent previously approved version (juan-cortes) on 2024-01-23. It has since remained available on npm for 913 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.29.1
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-12-12. It has since remained available on npm for 955 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.29.0
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-11-24. It has since remained available on npm for 973 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.28.0
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-11-09. It has since remained available on npm for 988 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.19
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-08-16. It has since remained available on npm for 1073 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.18
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-08-07. It has since remained available on npm for 1082 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.17
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-07-18. It has since remained available on npm for 1102 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.16
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-06-23. It has since remained available on npm for 1127 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.15
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-05-26. It has since remained available on npm for 1155 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.14
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-05-09. It has since remained available on npm for 1172 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.13
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-04-03. It has since remained available on npm for 1208 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.12
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-02-15. It has since remained available on npm for 1255 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.11
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-02-06. It has since remained available on npm for 1264 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.10
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2023-01-13. It has since remained available on npm for 1288 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.9
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2022-12-22. It has since remained available on npm for 1310 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.8
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2022-11-30. It has since remained available on npm for 1332 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.7
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2022-11-18. It has since remained available on npm for 1344 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.6
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2022-09-30. It has since remained available on npm for 1393 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.27.5
2 findingsThis version was published by a different npm account (sergii-shkolin) than the most recent previously approved version (juan-cortes) on 2022-09-28. It has since remained available on npm for 1395 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.