@polymarket/clob-client
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): All new maintainers have Polymarket-affiliated handles; consistent with org team expansion, not takeover. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publishing with SLSA provenance; consistent with Polymarket org CI/CD migration. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy explained by CI/CD pipeline migration; SLSA provenance attestation confirms legitimate org-controlled publish. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): viem is a well-established Ethereum library; added as part of documented ethers→viem migration. | ai | |
| phantom-deps | phantom-dep:browser-or-node | AI (phantom-deps): Transitive dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@ethersproject/units | AI (phantom-deps): Transitive dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@ethersproject/wallet | AI (phantom-deps): Transitive dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@ethersproject/providers | AI (phantom-deps): Transitive dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@polymarket/builder-signing-sdk | AI (phantom-deps): Same-org scoped package; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@polymarket/order-utils | AI (phantom-deps): Same-org scoped package; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Transitive dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:ethers | AI (phantom-deps): Transitive dependency; stable pattern for this package. | ai | |
| dependencies | unvetted-dep:@polymarket/builder-signing-sdk | AI (dependencies): First-party Polymarket dependency from the same org; consistent with the package's established ecosystem. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 5.8.1 | 4 / 10 | |
| 5.8.0 | 4 / 10 | |
| 5.7.0 | 4 / 10 | |
| 5.5.0 | 9 / 20 | |
| 5.3.0 | 8 / 21 | |
| 5.2.4 | 9 / 27 | |
| 5.2.3 | 9 / 27 | |
| 5.2.2 | 9 / 27 | |
| 5.2.1 | 9 / 27 | |
| 5.2.0 | 9 / 27 | |
| 5.1.3 | 9 / 27 | |
| 5.1.2 | 9 / 27 | |
| 5.1.1 | 9 / 27 | |
| 5.1.0 | 9 / 27 | |
| 5.0.1 | 9 / 27 | |
| 5.0.0 | 9 / 27 |
v5.8.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.7.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-04. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.5.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-27. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.4
2 findingsThis version was published by a different npm account than previous versions on 2026-02-19. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.3
2 findingsThis version was published by a different npm account than previous versions on 2026-02-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.2
2 findingsThis version was published by a different npm account than previous versions on 2026-02-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.1
2 findingsThis version was published by a different npm account than previous versions on 2026-01-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-06. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.3
2 findingsThis version was published by a different npm account than previous versions on 2025-12-26. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.