@rhinestone/sdk
End-to-end chain abstraction and modularity toolkit
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/src/accounts/nexus.test.js | AI (source-diff): Long hex strings are ABI-encoded factory calldata in unit tests, not malicious payloads. | ai | |
| source-diff | encoded-string-file:dist/src/accounts/kernel.test.js | AI (source-diff): Long hex strings are ABI-encoded factory calldata used in unit tests for ERC-4337 account deployment. | ai | |
| source-diff | encoded-string-file:dist/src/accounts/safe.test.js | AI (source-diff): Long hex strings are ABI-encoded Safe factory calldata in unit tests. | ai | |
| provenance | publisher-changed | AI (provenance): Rhinestone migrated publishing to GitHub Actions CI with SLSA attestation; this is the expected new publisher going forward. | ai | |
| phantom-deps | phantom-dep:solady | AI (phantom-deps): solady is listed as a runtime dep in package.json; heuristic false positive for this EVM SDK. | ai | |
| source-diff | encoded-string-file:dist/src/accounts/safe.js | AI (source-diff): SAFE_PROXY_INIT_CODE is EVM contract bytecode constant, not a malicious payload. | ai | |
| source-diff | encoded-string-file:dist/src/modules/validators/core.js | AI (source-diff): Long hex strings are EVM bytecode/mock signatures — standard for EVM SDKs embedding contract init code. | ai | |
| source-diff | encoded-string-file:dist/src/accounts/nexus.js | AI (source-diff): NEXUS_CREATION_CODE is EVM contract bytecode constant, not a malicious payload. | ai | |
| source-diff | encoded-string-file:dist/src/accounts/startale.js | AI (source-diff): CREATION_CODE is EVM contract bytecode constant, not a malicious payload. | ai | |
| dependencies | unvetted-dep:ox | AI (dependencies): ox is a legitimate Ethereum utility library; expected dependency for an Ethereum SDK. | ai | |
| dependencies | unvetted-dep:@rhinestone/shared-configs | AI (dependencies): Same-org internal config package; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Established Rhinestone org package; absence of Sigstore provenance is common and not a risk signal here. | ai |
Versions (showing 51 of 85)
| Version | Deps | Published |
|---|---|---|
| 2.0.0 | 1 / 0 | |
| 1.13.0 | 2 / 0 | |
| 1.12.0 | 2 / 0 | |
| 1.11.0 | 2 / 0 | |
| 1.10.0 | 2 / 0 | |
| 1.9.2 | 2 / 0 | |
| 1.9.1 | 2 / 0 | |
| 1.9.0 | 2 / 0 | |
| 1.8.0 | 2 / 0 | |
| 1.7.0 | 2 / 0 | |
| 1.6.5 | 2 / 0 | |
| 1.6.4 | 2 / 0 | |
| 1.6.3 | 2 / 0 | |
| 1.6.2 | 2 / 0 | |
| 1.6.1 | 2 / 0 | |
| 1.6.0 | 2 / 0 | |
| 1.5.1 | 2 / 0 | |
| 1.5.0 | 2 / 0 | |
| 1.4.2 | 3 / 0 | |
| 1.4.1 | 3 / 0 | |
| 1.2.17 | 3 / 0 | |
| 1.2.16 | 3 / 0 | |
| 1.2.15 | 3 / 0 | |
| 1.2.14 | 3 / 0 | |
| 1.2.13 | 3 / 0 | |
| 1.2.12 | 3 / 0 | |
| 1.2.10 | 3 / 0 | |
| 1.2.9 | 3 / 0 | |
| 1.2.8 | 3 / 0 | |
| 1.2.7 | 3 / 0 | |
| 1.2.6 | 3 / 0 | |
| 1.2.5 | 3 / 0 | |
| 1.2.4 | 3 / 0 | |
| 1.2.3 | 3 / 0 | |
| 1.2.2 | 3 / 0 | |
| 1.2.1 | 3 / 0 | |
| 1.2.0 | 3 / 0 | |
| 1.1.3 | 3 / 0 | |
| 1.1.2 | 3 / 0 | |
| 1.1.1 | 3 / 0 | |
| 1.1.0 | 3 / 0 | |
| 1.0.43 | 3 / 0 | |
| 1.0.42 | 3 / 0 | |
| 1.0.41 | 3 / 0 | |
| 1.0.40 | 3 / 0 | |
| 1.0.39 | 3 / 0 | |
| 1.0.38 | 3 / 0 | |
| 1.0.37 | 3 / 0 | |
| 1.0.36 | 3 / 0 | |
| 1.0.35 | 3 / 0 | |
| 1.0.34 | 3 / 0 |
v2.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.13.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.11.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.