@metamask/sdk

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:pump	AI (phantom-deps): pump is a declared runtime dep used transitively in stream handling; phantom-dep heuristic false positive for this package.	ai	2026/04/28
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a known implicit TypeScript runtime dep; stable false positive for this package.	ai	2026/04/28
phantom-deps	phantom-dep:bowser	AI (phantom-deps): bowser is a declared dep used in bundled browser builds; phantom-dep heuristic false positive.	ai	2026/04/28
phantom-deps	phantom-dep:eciesjs	AI (phantom-deps): eciesjs is a declared dep used in bundled output; phantom-dep heuristic false positive.	ai	2026/04/28
phantom-deps	phantom-dep:@paulmillr/qr	AI (phantom-deps): Declared dep used in bundled output; phantom-dep heuristic false positive.	ai	2026/04/28
phantom-deps	phantom-dep:obj-multiplex	AI (phantom-deps): Declared dep used in bundled output; phantom-dep heuristic false positive.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/runtime	AI (phantom-deps): Framework-scoped Babel runtime dep; stable false positive for this package.	ai	2026/04/28
phantom-deps	phantom-dep:eth-rpc-errors	AI (phantom-deps): Declared dep used in bundled output; phantom-dep heuristic false positive.	ai	2026/04/28
phantom-deps	phantom-dep:@metamask/onboarding	AI (phantom-deps): Same-org scoped dep used in bundled output; phantom-dep heuristic false positive.	ai	2026/04/28

Version	Deps	Published
0.34.0	20 / 55	2025-11-14