@ledgerhq/live-cli
ledger-live CLI version
10
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
phenry-ledgersergii-shkolingbrahm-ledgerthomas.coudrayldg-github-civbouzonledger-releaser
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:superagent | AI (phantom-deps): Bundled CLI; deps inlined into build output. | ai | |
| phantom-deps | phantom-dep:qrloop | AI (phantom-deps): Stable false positive; qrloop used indirectly in CLI bundle. | ai | |
| phantom-deps | phantom-dep:command-line-args | AI (phantom-deps): Stable false positive; command-line-args used indirectly. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:asciichart | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:body-parser | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:bignumber.js | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:bigint-buffer | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:qrcode-terminal | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:got | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:usb | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:cors | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:pako | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:bip39 | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:node-hid | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:invariant | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:purify-ts | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Monorepo CLI; deps used transitively in bundled output, not direct imports. | ai | |
| provenance | no-provenance | AI (provenance): LedgerHQ is an established org; lack of Sigstore provenance is common and not a disqualifier here. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard Solana VersionedTransaction deserialization from base64. Expected pattern in a hardware wallet CLI. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Bundler artifact (rslib) using require('url'.replace('','')) to reference Node built-ins without static analysis interference. Not malicious. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hardcoded zero-byte hex literals used for protocol validation assertions, not payload decoding. False positive for this crypto wallet CLI. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in a Proxy handler is idiomatic JavaScript, not obfuscation. Common pattern in bundled code. | ai |