@ledgerhq/ledger-key-ring-protocol
Ledger Key Ring Protocol layer
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:src/__tests__/unit/sdk.test.ts | AI (source-diff): Long hex string is a mock TLS challenge TLV in a test fixture; not a malicious payload. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 usage in qrcode/index.js is a standard round-trip validation check, not payload obfuscation. Stable false positive for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is in test files loading local scenario modules — standard test pattern, not a runtime security risk. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a declared runtime dependency in package.json; used via isomorphic-ws. False positive from config-file analysis. | ai |
Versions (showing 41 of 41)
| Version | Deps | Published |
|---|---|---|
| 0.15.2 | 13 / 11 | |
| 0.15.1 | 13 / 11 | |
| 0.15.0 | 13 / 11 | |
| 0.14.0 | 13 / 11 | |
| 0.13.3 | 13 / 11 | |
| 0.13.2 | 13 / 11 | |
| 0.13.1 | 13 / 11 | |
| 0.13.0 | 13 / 11 | |
| 0.12.4 | 13 / 9 | |
| 0.12.3 | 13 / 9 | |
| 0.12.2 | 13 / 9 | |
| 0.12.1 | 13 / 9 | |
| 0.12.0 | 13 / 9 | |
| 0.11.5 | 13 / 8 | |
| 0.11.4 | 13 / 8 | |
| 0.11.3 | 13 / 8 | |
| 0.11.2 | 13 / 8 | |
| 0.11.1 | 13 / 8 | |
| 0.11.0 | 13 / 8 | |
| 0.10.0 | 13 / 7 | |
| 0.9.0 | 13 / 7 | |
| 0.8.1 | 13 / 7 | |
| 0.8.0 | 13 / 7 | |
| 0.7.1 | 13 / 7 | |
| 0.7.0 | 13 / 7 | |
| 0.6.8 | 13 / 7 | |
| 0.6.7 | 13 / 7 | |
| 0.6.6 | 13 / 7 | |
| 0.6.5 | 13 / 7 | |
| 0.6.4 | 13 / 7 | |
| 0.6.3 | 13 / 7 | |
| 0.6.2 | 13 / 7 | |
| 0.6.0 | 13 / 7 | |
| 0.5.11 | 13 / 7 | |
| 0.5.10 | 13 / 7 | |
| 0.5.9 | 13 / 7 | |
| 0.5.8 | 13 / 7 | |
| 0.5.7 | 13 / 7 | |
| 0.5.3 | 13 / 7 | |
| 0.5.2 | 13 / 7 | |
| 0.5.1 | 13 / 7 |
v0.15.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.