@multiversx/sdk-dapp-swap
A library to hold the main logic for swapping between tokens on the MultiversX blockchain
23
Versions
GPL-3.0-or-later
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
radumojicarhtudormorarandreibancioiuvalentinlupccorcoveanucipriandlucian.mincutiteldragosrebegeap0pebogdan-rosianuclaudiu.lataretu
Keywords
multiversxblockchaindappsmart-contracttransaction
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:__commonjs/hooks/useTokenPriceSubscription.js | AI (source-diff): Standard esbuild CJS bundle output; minified format is expected for this package's __commonjs distribution directory. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing with SLSA provenance attestation; consistent with legitimate automation migration for this org. | ai | |
| source-diff | obfuscated-file:hooks/useFetchTokenPrices.js | AI (source-diff): Standard esbuild ESM bundle output with chunk imports; not obfuscation. | ai | |
| source-diff | obfuscated-file:__commonjs/hooks/useFetchTokenPrices.js | AI (source-diff): CJS build artifact from esbuild; __commonjs is the declared main entry for this package's build pipeline. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are esbuild CJS bundle outputs; expected for this package's build structure. | ai | |
| source-diff | obfuscated-file:__commonjs/utils/getHasEnoughBalance.js | AI (source-diff): Standard esbuild minified CJS bundle output; not obfuscated malware. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:sass | AI (phantom-deps): sass is a build-time dependency used via esbuild-sass-plugin; not directly imported in source. | ai | |
| phantom-deps | phantom-dep:anchorme | AI (phantom-deps): Listed as runtime dep; likely re-exported or used indirectly in build output. | ai | |
| phantom-deps | phantom-dep:react-bootstrap-typeahead | AI (phantom-deps): Listed as runtime dep; likely re-exported or used indirectly in build output. | ai | |
| phantom-deps | phantom-dep:bech32 | AI (phantom-deps): Listed as runtime dep in package.json; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 23 of 23)
| Version | Deps | Published |
|---|---|---|
| 4.3.0 | 7 / 50 | |
| 4.2.1 | 7 / 53 | |
| 4.2.0 | 7 / 52 | |
| 4.1.9 | 7 / 52 | |
| 4.1.8 | 7 / 52 | |
| 4.1.7 | 7 / 52 | |
| 4.1.6 | 7 / 52 | |
| 4.1.5 | 7 / 52 | |
| 4.1.4 | 7 / 52 | |
| 4.1.3 | 7 / 52 | |
| 4.1.2 | 7 / 52 | |
| 4.1.1 | 7 / 52 | |
| 4.1.0 | 7 / 52 | |
| 4.0.9 | 7 / 50 | |
| 4.0.8 | 7 / 50 | |
| 4.0.7 | 7 / 50 | |
| 4.0.6 | 7 / 50 | |
| 4.0.5 | 7 / 50 | |
| 4.0.4 | 7 / 50 | |
| 4.0.3 | 7 / 50 | |
| 4.0.2 | 8 / 50 | |
| 4.0.1 | 6 / 50 | |
| 4.0.0 | 7 / 48 |
v4.3.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.