← Home

@privy-io/node

npm Repository Homepage
31
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

payton-privysternhenriasta-liahollenbachankushswar1joshnaviprivyajin-privyandrewprivyadmin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:resources/wallets/wallets.d.ts AI (source-diff): Hex tx example in JSDoc doc comment of type-def file; benign for this crypto SDK. ai
source-diff encoded-string-file:resources/wallets/wallets.d.mts AI (source-diff): Hex example data in JSDoc comments for wallet signing API; stable false positive. ai
source-diff encoded-string-file:resources/wallets/wallets.js AI (source-diff): Hex string is a documentation example in a JSDoc comment, not an executable payload. ai
source-diff encoded-string-file:resources/wallets/wallets.mjs AI (source-diff): Same JSDoc example hex string in ESM variant; not executable. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding of cryptographic keys is core functionality of this wallet/crypto SDK. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding of wallet entropy is expected in a crypto/wallet SDK. ai
typosquat typosquat.levenshtein:zod AI (typosquat): Scoped package @privy-io/node is not a typosquat of zod; Levenshtein match is spurious. ai

Versions (showing 31 of 31)

Version Deps Published
0.27.0 9 / 0
0.26.0 9 / 0
0.25.0 9 / 0
0.24.0 9 / 0
0.23.0 9 / 0
0.22.0 9 / 0
0.21.0 9 / 0
0.20.0 9 / 0
0.19.0 9 / 0
0.18.0 9 / 0
0.17.0 9 / 0
0.16.0 9 / 0
0.15.0 9 / 0
0.14.0 9 / 0
0.13.0 9 / 0
0.12.0 9 / 0
0.11.0 9 / 0
0.10.1 9 / 0
0.10.0 9 / 0
0.9.0 9 / 0
0.8.0 9 / 0
0.7.0 9 / 0
0.6.2 9 / 0
0.6.1 9 / 0
0.6.0 9 / 0
0.5.0 9 / 0
0.4.1 9 / 0
0.4.0 9 / 0
0.3.0 9 / 0
0.2.0 8 / 0
0.1.0 8 / 0

v0.27.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.26.0

2 findings
HIGH Long encoded string in modified file: resources/wallets/wallets.d.ts source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.25.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.24.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.