@permaweb/libs — Greenflagged

Documentation for this SDK can be found at the [top level](https://github.com/permaweb/permaweb-libs) of the repository.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

nickj_arweavepermatom

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Bundled dependency (arbundles + crypto libs) inflates dist size, not injected payload.	ai	2026/07/12
dependencies	unvetted-dep:@dha-team/arbundles	AI (dependencies): Arweave-ecosystem dep matching publisher's own org.	ai	2026/07/12
npm-metadata	url-dep:@arx/sdk	AI (npm-metadata): file: path is a local sibling package in this org's monorepo.	ai	2026/07/12
dependencies	unvetted-dep:@arx/sdk	AI (dependencies): Local monorepo path within same org, not external unvetted code.	ai	2026/07/12
source-diff	obfuscated-file:dist/index.cjs	AI (source-diff): esbuild-bundled dist output, not true obfuscation.	ai	2026/07/12
source-diff	net-exec-file:dist/bundle.esm.js	AI (source-diff): Bundled arweave SDK network calls, no dropper behavior.	ai	2026/07/12
phantom-deps	phantom-dep:crypto-browserify	AI (phantom-deps): Browser polyfill referenced in esbuild config; stable for this package.	ai	2026/05/10
phantom-deps	phantom-dep:@ardrive/turbo-sdk	AI (phantom-deps): Build-time/config reference; stable false positive for this package.	ai	2026/05/10
phantom-deps	phantom-dep:esbuild-plugin-alias	AI (phantom-deps): Build-time plugin referenced in config; stable false positive.	ai	2026/05/10
phantom-deps	phantom-dep:web-streams-polyfill	AI (phantom-deps): Browser polyfill referenced in esbuild config; stable for this package.	ai	2026/05/10
phantom-deps	phantom-dep:esbuild-plugin-polyfill-node	AI (phantom-deps): Build-time plugin referenced in config; stable false positive.	ai	2026/05/10
phantom-deps	phantom-dep:stream-browserify	AI (phantom-deps): Browser polyfill referenced in esbuild config; stable for this package.	ai	2026/05/10
phantom-deps	phantom-dep:arweave	AI (phantom-deps): Build-time polyfill/config reference pattern; stable for this dual-build package.	ai	2026/05/10
phantom-deps	phantom-dep:process	AI (phantom-deps): Build-time polyfill/config reference pattern; stable for this dual-build package.	ai	2026/05/10
phantom-deps	phantom-dep:tsc-alias	AI (phantom-deps): Build-time tool referenced in config; stable for this package.	ai	2026/05/10
phantom-deps	phantom-dep:@permaweb/arx	AI (phantom-deps): Same-org dep referenced in build config; stable false positive.	ai	2026/05/10
phantom-deps	phantom-dep:os-browserify	AI (phantom-deps): Browser polyfill referenced in esbuild config; stable for this package.	ai	2026/05/10
source-diff	encoded-string-file:dist/index.js	AI (source-diff): Long strings are esbuild minified output (polyfills/bundled deps), not obfuscated payloads.	ai	2026/05/08
source-diff	encoded-string-file:dist/index.esm.js	AI (source-diff): Long strings are esbuild minified output (polyfills/bundled deps), not obfuscated payloads.	ai	2026/05/08
source-diff	encoded-string-file:dist/index.cjs	AI (source-diff): Long strings are esbuild minified output (polyfills/bundled deps), not obfuscated payloads.	ai	2026/05/08
bogus-package	bogus-package	AI (bogus-package): Sparse README/no keywords is cosmetic; package is a legitimate permaweb SDK with 81 versions and a real GitHub repo.	ai	2026/05/04
phantom-deps	phantom-dep:@dha-team/arbundles	AI (phantom-deps): Declared dep used indirectly via bundled output; phantom-dep false positive for this package.	ai	2026/05/04

Versions (showing 61 of 61)

Version	Deps	Published
0.0.94	2 / 23	2026-06-16
0.0.93	2 / 23	2026-05-01
0.0.92	2 / 23	2026-04-27
0.0.91	2 / 23	2026-03-18
0.0.90	2 / 23	2026-03-12
0.0.89	2 / 23	2026-03-04
0.0.88	2 / 23	2026-03-04
0.0.87	2 / 23	2026-03-03
0.0.86	1 / 23	2026-02-18
0.0.85	1 / 23	2026-01-28
0.0.84	1 / 23	2026-01-23
0.0.83	1 / 23	2026-01-22
0.0.82	1 / 23	2026-01-20
0.0.81	1 / 23	2026-01-19
0.0.80	1 / 23	2026-01-15
0.0.79	1 / 23	2026-01-06
0.0.78	1 / 23	2025-12-30
0.0.77	1 / 23	2025-12-27
0.0.76	1 / 23	2025-12-23
0.0.75	1 / 23	2025-12-23
0.0.74	1 / 23	2025-12-02
0.0.73	1 / 23	2025-11-24
0.0.72	1 / 23	2025-11-23
0.0.71	1 / 23	2025-11-23
0.0.70	1 / 23	2025-11-21
0.0.69	1 / 23	2025-11-08
0.0.68	1 / 23	2025-11-04
0.0.67	1 / 23	2025-11-03
0.0.66	1 / 23	2025-10-29
0.0.64	1 / 23	2025-10-21
0.0.63	1 / 21	2025-10-16
0.0.55	1 / 21	2025-09-08
0.0.54	1 / 21	2025-09-03
0.0.53	1 / 21	2025-08-26
0.0.52	1 / 21	2025-08-14
0.0.51	1 / 21	2025-08-13
0.0.38	0 / 17	2025-05-23
0.0.37	0 / 17	2025-05-21
0.0.36	12 / 13	2025-05-13
0.0.35	12 / 13	2025-04-28
0.0.34	12 / 13	2025-04-17
0.0.33	13 / 13	2025-04-11
0.0.32	11 / 13	2025-04-11
0.0.29	11 / 13	2025-04-09
0.0.26	4 / 13	2025-02-17
0.0.25	4 / 13	2025-02-07
0.0.24	4 / 13	2025-01-31
0.0.23	4 / 13	2025-01-28
0.0.22	4 / 13	2025-01-24
0.0.21	4 / 13	2025-01-23
0.0.20	4 / 13	2025-01-17
0.0.19	4 / 13	2025-01-17
0.0.18	4 / 13	2025-01-16
0.0.17	4 / 13	2025-01-14
0.0.16	2 / 8	2024-12-12
0.0.15	2 / 8	2024-12-06
0.0.14	2 / 8	2024-11-27
0.0.13	2 / 8	2024-11-27
0.0.12	2 / 8	2024-11-22
0.0.11	2 / 8	2024-11-22
0.0.1	2 / 7	2024-10-25

v0.0.92

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.89

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.83

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.74

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.67

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.66

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.64

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.63

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.55

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.54

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.53

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.52

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.51

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.34

2 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.33

2 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.32

2 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.29

2 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.26

2 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.25

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.24

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.23

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.22

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.21

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.20

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.19

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.18

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.17

3 findings

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/bundle.esm.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.