← Home

@sentio/sdk

npm Repository
11
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

longwallendragonphilz3906pooytr1rnonslzx_lizixingfrozenluo

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff large-new-source-files AI (source-diff): New Starknet chain support explains added generated source files. ai
dependencies unvetted-dep:@sentio/bigdecimal AI (dependencies): First-party Sentio dependency, consistent with monorepo pattern. ai
dependencies unvetted-dep:@anchor-lang/core AI (dependencies): Official Solana/Anchor ecosystem package, part of migration from @coral-xyz/anchor. ai
bogus-package bogus-package AI (bogus-package): Scoped SDK package; missing description/repo/keywords are cosmetic issues, not malware indicators. ai
source-diff encoded-string-file:lib/eth/eth.js AI (source-diff): Long hex strings are Ethereum transaction data in comments — not executable payloads. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher with SLSA provenance attestation; consistent with CI/CD automation for this active SDK. ai
phantom-deps phantom-dep:got AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:yaml AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:radash AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:p-queue AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:@coral-xyz/borsh AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:nice-grpc-prometheus AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:nice-grpc-client-middleware-retry AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
phantom-deps phantom-dep:bs58 AI (phantom-deps): Large SDK with many modules; phantom-dep heuristic unreliable for this package. ai
source-diff encoded-string-file:lib/aptos/builtin/0x1.js AI (source-diff): Move module bytecode embedded as JSON strings — established pattern in this SDK's Aptos builtin files. ai
source-diff encoded-string-file:lib/aptos/builtin/0x3.js AI (source-diff): Move module bytecode embedded as JSON strings — established pattern in this SDK's Aptos builtin files. ai
source-diff encoded-string-file:lib/aptos/builtin/0x4.js AI (source-diff): Move module bytecode embedded as JSON strings — established pattern in this SDK's Aptos builtin files. ai
semgrep semgrep:shady-links-tlds AI (semgrep): Token list URLs with .xyz TLDs; legitimate DeFi project domains, not C2. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Standard Proxy/Reflect.get pattern for metrics instrumentation. ai
semgrep semgrep:base64-decode AI (semgrep): Aptos Move ABI argument decoding from base64; standard blockchain SDK pattern. ai
semgrep semgrep:hex-decode AI (semgrep): Standard Move/Aptos type string decoding from hex-encoded module names. ai

Versions (showing 11 of 11)

Version Deps Published
4.0.0 39 / 2
3.8.1 40 / 2
3.8.0 40 / 2
3.7.0 40 / 2
3.6.2 40 / 2
3.6.1 40 / 2
3.6.0 40 / 2
3.5.0 42 / 2
2.63.1 42 / 2
2.63.0 42 / 2
2.62.6 42 / 2

v2.63.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.62.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.