@openclaw/nostr — Greenflagged

OpenClaw Nostr channel plugin for NIP-04 encrypted DMs

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

steipetevincentkoc

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Package migrated to GitHub Actions CI publishing with SLSA attestation; this is the expected publisher going forward.	ai	2026/05/09
maintainer-change	maintainer-added	AI (maintainer-change): vincentkoc added as maintainer alongside CI migration; consistent with legitimate project handoff/expansion.	ai	2026/05/09
semgrep	semgrep:etc-passwd-access	AI (semgrep): Appears only in a fuzz test validating that file:///etc/passwd URLs are rejected — not credential harvesting.	ai	2026/05/01
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): Raw IP appears in a test asserting SSRF protection (private IP rejection), not in production code.	ai	2026/05/01

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.