← Home

@openzeppelin/upgrades-core

npm Repository Homepage
4
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

ernestognwfrangioamxxericglauarr00luiz-lvjson-oz

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:fp-ts AI (phantom-deps): fp-ts/io-ts ecosystem dep likely used indirectly; not a malicious install-script vector. ai
provenance missing-githead AI (provenance): Established OZ package; missing gitHead reflects publish-env change, no malicious behavior. ai
publish-pattern dormant-publish AI (publish-pattern): Long gap explained by CI migration; package is actively maintained on GitHub. ai
provenance publisher-changed AI (provenance): Transition from individual maintainer to GitHub Actions CI/CD; consistent with SLSA provenance attestation. ai
npm-metadata no-description AI (npm-metadata): Empty description is a metadata oversight on a well-known package. ai
dependencies unvetted-dep:ethereumjs-util AI (dependencies): ethereumjs-util is a standard Ethereum utility library; its use is expected and appropriate in an Ethereum upgrade tooling package. ai
dependencies unvetted-dep:@nomicfoundation/slang AI (dependencies): @nomicfoundation/slang is a Solidity parser from Nomic Foundation (Hardhat team), a reputable Ethereum org. Appropriate dependency for Solidity upgrade analysis tooling. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding in this package is standard Ethereum ABI data parsing (stripping 0x prefix from on-chain encoded strings). No obfuscation or malicious payload; stable false positive for this package. ai

Versions (showing 4 of 104)

Version Deps Published
1.1.0 10 / 13
1.0.2 10 / 13
1.0.1 10 / 13
1.0.0 10 / 13

v1.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.