@mysten/ledgerjs-hw-app-sui

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

ebmifahayespaul-mystenrushrs

LedgerLedgerWalletLedgerSignerSuiNanoSBlueHardware Wallet

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Transition from personal account (ebmifa) to GitHub Actions CI publishing is a supply chain improvement, not a takeover. SLSA provenance attestation confirms legitimate CI build.	ai	2026/04/27
source-diff	net-exec-file:dist/Sui.mjs	AI (source-diff): dist/Sui.mjs is a rolldown bundle that inlines previously-external @ledgerhq/* runtime deps. Network imports are from bundled transport libraries, not malicious code. SLSA attestation confirms build integrity.	ai	2026/04/27
source-diff	source-size-tripled	AI (source-diff): Size increase from 44KB to 940KB is explained by bundling 8 previously-external @ledgerhq/* runtime deps into the output via tsdown/rolldown migration.	ai	2026/04/27
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy followed by legitimate org-owned CI publish with SLSA provenance. Mysten Labs is the established Sui blockchain team with 191 versions in registry.	ai	2026/04/27
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding is used to convert Ledger trust service token descriptor data and signatures into binary buffers — standard cryptographic handling for a hardware wallet integration, not a malicious payload.	ai	2026/04/26
phantom-deps	phantom-dep:@ledgerhq/ledger-trust-service	AI (phantom-deps): @ledgerhq/ledger-trust-service is a declared runtime dependency used in config/indirect references; not a security risk for this legitimate Ledger integration package.	ai	2026/04/26