@nomicfoundation/slang — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Keywords

blockchaincompilersdappsethereumparsingsmart-contractssoliditytooling

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): CI publish retains SLSA attestation; gitHead absence is benign for this package.	ai	2026/07/16
npm-metadata	bundled-binaries	AI (npm-metadata): Rust-compiled WASM parser artifacts are core to this package; stable across versions.	ai	2026/07/08

Versions (showing 7 of 7)

Version	Deps	Published
1.3.7	1 / 0	2026-07-13
1.3.6	1 / 0	2026-06-09
1.3.5	1 / 0	2026-05-06
1.3.4	1 / 0	2026-02-26
1.3.3	1 / 0	2026-02-19
1.3.2	1 / 0	2025-12-22
1.3.1	1 / 0	2025-12-11

v1.3.7

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.3

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • wasm/generated/solidity_cargo_wasm.component.core.wasm • wasm/generated/solidity_cargo_wasm.component.core2.wasm • wasm/generated/solidity_cargo_wasm.component.core3.wasm • wasm/generated/solidity_cargo_wasm.component.core4.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.2

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • wasm/generated/solidity_cargo_wasm.component.core.wasm • wasm/generated/solidity_cargo_wasm.component.core2.wasm • wasm/generated/solidity_cargo_wasm.component.core3.wasm • wasm/generated/solidity_cargo_wasm.component.core4.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • wasm/generated/solidity_cargo_wasm.component.core.wasm • wasm/generated/solidity_cargo_wasm.component.core2.wasm • wasm/generated/solidity_cargo_wasm.component.core3.wasm • wasm/generated/solidity_cargo_wasm.component.core4.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.