@metamask/transaction-controller
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from metamaskbot to GitHub Actions CI; SLSA attestation confirms legitimate CI/CD publish. | ai | |
| source-diff | encoded-string-file:dist/constants.cjs | AI (source-diff): EVM bytecode constant (CODE_DELEGATION_MANAGER_NO_SIGNATURE_ERRORS); legitimate pattern for Ethereum tooling. | ai | |
| source-diff | encoded-string-file:dist/constants.d.cts | AI (source-diff): Type declaration for EVM bytecode constant; not a payload. | ai | |
| source-diff | encoded-string-file:dist/constants.d.mts | AI (source-diff): Type declaration for EVM bytecode constant; not a payload. | ai | |
| source-diff | encoded-string-file:dist/constants.mjs | AI (source-diff): EVM bytecode constant in ESM build; legitimate pattern for Ethereum tooling. | ai | |
| phantom-deps | phantom-dep:@ethereumjs/util | AI (phantom-deps): @ethereumjs/util is a declared runtime dep in package.json; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 51 of 62)
| Version | Deps | Published |
|---|---|---|
| 69.2.1 | 26 / 20 | |
| 69.2.0 | 26 / 20 | |
| 69.1.0 | 26 / 20 | |
| 69.0.0 | 27 / 20 | |
| 68.4.0 | 27 / 20 | |
| 68.3.0 | 27 / 20 | |
| 68.2.2 | 27 / 20 | |
| 68.2.1 | 27 / 20 | |
| 68.2.0 | 27 / 20 | |
| 68.1.1 | 27 / 20 | |
| 68.1.0 | 27 / 20 | |
| 68.0.1 | 27 / 20 | |
| 68.0.0 | 27 / 20 | |
| 67.1.0 | 27 / 20 | |
| 67.0.0 | 27 / 20 | |
| 66.0.1 | 27 / 20 | |
| 66.0.0 | 27 / 20 | |
| 65.4.0 | 27 / 20 | |
| 65.3.0 | 27 / 20 | |
| 65.2.0 | 27 / 20 | |
| 65.1.0 | 27 / 20 | |
| 65.0.0 | 27 / 20 | |
| 64.4.0 | 27 / 20 | |
| 64.3.0 | 27 / 20 | |
| 64.2.0 | 27 / 20 | |
| 64.1.0 | 27 / 20 | |
| 64.0.0 | 27 / 20 | |
| 63.3.1 | 28 / 19 | |
| 63.3.0 | 28 / 19 | |
| 63.2.0 | 28 / 19 | |
| 63.1.0 | 28 / 19 | |
| 63.0.0 | 28 / 19 | |
| 62.22.0 | 28 / 18 | |
| 62.21.0 | 28 / 18 | |
| 62.20.0 | 28 / 18 | |
| 62.19.0 | 28 / 18 | |
| 62.18.0 | 28 / 18 | |
| 62.17.1 | 28 / 18 | |
| 62.17.0 | 28 / 19 | |
| 62.16.0 | 28 / 18 | |
| 62.15.0 | 28 / 18 | |
| 62.14.0 | 28 / 18 | |
| 62.13.0 | 28 / 18 | |
| 62.12.0 | 28 / 18 | |
| 62.11.0 | 28 / 18 | |
| 62.10.0 | 28 / 18 | |
| 62.9.2 | 27 / 18 | |
| 62.9.1 | 27 / 18 | |
| 62.9.0 | 27 / 18 | |
| 62.8.0 | 27 / 18 | |
| 62.7.0 | 27 / 18 |
v69.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v69.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v69.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v69.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v68.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v68.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v68.2.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v68.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.