@ledgerhq/live-wallet
Ledger Live wallet
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): CI publisher account with long clean track record across 1605 approvals. | ai | |
| dependencies | unvetted-dep:@ledgerhq/trustchain | AI (dependencies): First-party LedgerHQ package within same monorepo ecosystem. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party or well-established libraries, not suspicious. | ai | |
| npm-metadata | url-dep:@ledgerhq/compressjs | AI (npm-metadata): Commit-pinned GitHub dep within LedgerHQ org; not an arbitrary swappable URL. | ai | |
| dependencies | unvetted-dep:@ledgerhq/compressjs | AI (dependencies): Pinned to a specific commit in the LedgerHQ org; stable pattern across versions of this package. | ai | |
| dependencies | unvetted-dep:@ledgerhq/ledger-key-ring-protocol | AI (dependencies): @ledgerhq/ledger-key-ring-protocol is a first-party LedgerHQ package; its use here is expected and consistent with the Ledger Live ecosystem. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is in a Jest mock file (src/walletsync/__mocks__/index.ts), not production code. No runtime risk to consumers. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Package is a component of the LedgerHQ monorepo; sparse README and small sub-entry-point are expected for internal library packages. | ai |
Versions (showing 51 of 57)
| Version | Deps | Published |
|---|---|---|
| 0.27.4 | 16 / 12 | |
| 0.27.3 | 16 / 12 | |
| 0.27.2 | 16 / 12 | |
| 0.27.1 | 16 / 12 | |
| 0.27.0 | 16 / 12 | |
| 0.26.0 | 16 / 12 | |
| 0.25.3 | 16 / 12 | |
| 0.25.2 | 16 / 12 | |
| 0.25.1 | 16 / 12 | |
| 0.25.0 | 16 / 12 | |
| 0.24.0 | 16 / 12 | |
| 0.23.0 | 16 / 11 | |
| 0.22.0 | 16 / 11 | |
| 0.21.4 | 16 / 11 | |
| 0.21.3 | 16 / 11 | |
| 0.21.2 | 16 / 11 | |
| 0.21.1 | 16 / 11 | |
| 0.21.0 | 16 / 11 | |
| 0.20.1 | 16 / 11 | |
| 0.20.0 | 16 / 11 | |
| 0.19.0 | 16 / 11 | |
| 0.18.0 | 16 / 10 | |
| 0.17.1 | 16 / 10 | |
| 0.17.0 | 16 / 10 | |
| 0.16.2 | 16 / 10 | |
| 0.16.1 | 16 / 10 | |
| 0.16.0 | 16 / 10 | |
| 0.15.0 | 16 / 10 | |
| 0.14.3 | 16 / 10 | |
| 0.14.2 | 16 / 10 | |
| 0.14.1 | 16 / 10 | |
| 0.14.0 | 16 / 10 | |
| 0.13.0 | 18 / 10 | |
| 0.12.2 | 18 / 10 | |
| 0.12.1 | 18 / 10 | |
| 0.12.0 | 18 / 10 | |
| 0.11.6 | 18 / 10 | |
| 0.11.5 | 18 / 10 | |
| 0.11.4 | 18 / 10 | |
| 0.11.3 | 18 / 10 | |
| 0.11.2 | 18 / 10 | |
| 0.11.1 | 18 / 10 | |
| 0.11.0 | 18 / 10 | |
| 0.10.11 | 18 / 10 | |
| 0.10.10 | 18 / 10 | |
| 0.10.9 | 18 / 10 | |
| 0.10.8 | 18 / 10 | |
| 0.10.7 | 18 / 10 | |
| 0.10.6 | 18 / 10 | |
| 0.10.5 | 18 / 10 | |
| 0.10.4 | 18 / 10 |
v0.27.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.