@solana-mobile/wallet-adapter-mobile
An adapter for mobile wallet apps that conform to the Solana Mobile Wallet Adapter protocol
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:bs58 | AI (phantom-deps): bs58 is a standard Solana ecosystem utility; implicit dependency is expected and stable for this package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit TypeScript runtime dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@solana-mobile/mobile-wallet-adapter-protocol-web3js | AI (phantom-deps): Same-org sibling protocol package; monorepo-style dependency is expected and stable for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): This is a legitimate SDK from the Solana Mobile org. README link dump reflects documentation links, not phishing. No-keywords is a style choice for a known technical package. | ai | |
| dependencies | unvetted-dep:@solana-mobile/mobile-wallet-adapter-protocol-web3js | AI (dependencies): First-party dependency from the same Solana Mobile organization and monorepo; expected dependency for this package. | ai | |
| dependencies | unvetted-dep:@solana-mobile/wallet-standard-mobile | AI (dependencies): First-party dependency from the same Solana Mobile organization and monorepo; expected dependency for this package. | ai | |
| dependencies | unvetted-dep:@solana-mobile/mobile-wallet-adapter-protocol | AI (dependencies): First-party dependency from the same Solana Mobile organization and monorepo; expected dependency for this package. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 2.2.8 | 9 / 5 | |
| 2.2.7 | 9 / 5 | |
| 2.2.6 | 9 / 5 | |
| 2.2.5 | 5 / 4 | |
| 2.2.4 | 5 / 4 | |
| 2.2.3 | 5 / 4 | |
| 2.2.2 | 5 / 4 | |
| 2.2.0 | 5 / 4 |
v2.2.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.