@solana/spl-token

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

[Accepted risk] This version was published by a different npm account than previous versions on 2026-07-09. This could indicate a legitimate maintainer transition or an account compromise.

All previous maintainers (nickfrosty, mcintyre94, 2501babe, lorisleiva, buffalojoec, ngundotra, _chido, steveluscher, seanyoung, tyera, joncinque, ryoqun, trent-solana, jordansexton) were replaced by new maintainers (solana-devs). This is a strong signal of a potential package hijack and requires careful review.

This version was published by a different npm account than previous versions on 2025-03-04. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account than previous versions on 2025-01-30. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

All previous maintainers (nickfrosty, mcintyre94, 2501babe, lorisleiva, buffalojoec, ngundotra, _chido, steveluscher, seanyoung, tyera, joncinque, ryoqun, trent-solana, jordansexton) were replaced by new maintainers (solana-devs). This is a strong signal of a potential package hijack and requires careful review.

This version was published by a different npm account than previous versions on 2025-01-28. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

All previous maintainers (nickfrosty, mcintyre94, 2501babe, lorisleiva, buffalojoec, ngundotra, _chido, steveluscher, seanyoung, tyera, joncinque, ryoqun, trent-solana, jordansexton) were replaced by new maintainers (solana-devs). This is a strong signal of a potential package hijack and requires careful review.

This version was published by a different npm account than previous versions on 2025-01-28. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account than previous versions on 2024-10-17. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (steveluscher) than the most recent previously approved version (joncinque) on 2024-04-19, but steveluscher is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (steveluscher) than the most recent previously approved version (joncinque) on 2024-04-19, but steveluscher is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (steveluscher) than the most recent previously approved version (joncinque) on 2024-04-18, but steveluscher is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: buffalojoec.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2024-03-23. It has since remained available on npm for 849 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: buffalojoec.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2024-03-22. It has since remained available on npm for 850 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: buffalojoec.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2024-02-24. It has since remained available on npm for 877 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: buffalojoec.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2024-01-29. It has since remained available on npm for 903 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: buffalojoec.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2024-01-09. It has since remained available on npm for 923 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: buffalojoec.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2024-01-03. It has since remained available on npm for 929 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (buffalojoec) than the most recent previously approved version (joncinque) on 2023-11-14. It has since remained available on npm for 979 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (joncinque) than the most recent previously approved version (jordansexton) on 2023-01-10, but joncinque is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (joncinque) than the most recent previously approved version (jordansexton) on 2022-10-28, but joncinque is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (jordansexton) than the most recent previously approved version (joncinque) on 2022-08-23, but jordansexton is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (jordansexton) than the most recent previously approved version (joncinque) on 2022-08-16, but jordansexton is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.