← Home

@stellar/stellar-sdk

npm Repository Homepage

A library for working with the Stellar network, including communication with the Horizon and Soroban RPC servers.

17
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

stellar-npm-cistellar-npmquietbitsjaceknfnando_sdfcassiomgpiyalbasu

Keywords

stellar

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Manual→GitHub Actions SLSA-attested CI publish; provenance improved. ai
provenance no-provenance AI (provenance): Unchanged provenance vs prior approved version; not a regression. ai
vendored-integrity unresolved-vendored-tree:lib/esm/node_modules/.pnpm/@[email protected]/node_modules/@stellar/js-xdr AI (vendored-integrity): Matches declared dependency version; pnpm nested store artifact. ai
vendored-integrity unresolved-vendored-tree:lib/esm/node_modules/.pnpm AI (vendored-integrity): pnpm store layout for declared @stellar/js-xdr dep, not an implant. ai
vendored-integrity unresolved-vendored-tree:lib/axios/esm/node_modules/.pnpm/@[email protected]/node_modules/@stellar/js-xdr AI (vendored-integrity): Matches declared dependency version; pnpm nested store artifact. ai
vendored-integrity unresolved-vendored-tree:lib/axios/esm/node_modules/.pnpm AI (vendored-integrity): pnpm store layout for declared @stellar/js-xdr dep, not an implant. ai
vendored-integrity unresolved-vendored-tree:lib/axios/cjs/node_modules/.pnpm AI (vendored-integrity): pnpm store layout for declared @stellar/js-xdr dep, not an implant. ai
vendored-integrity unresolved-vendored-tree:lib/axios/cjs/node_modules/.pnpm/@[email protected]/node_modules/@stellar/js-xdr AI (vendored-integrity): Matches declared dependency version; pnpm nested store artifact. ai
vendored-integrity unresolved-vendored-tree:lib/cjs/node_modules/.pnpm/@[email protected]/node_modules/@stellar/js-xdr AI (vendored-integrity): Matches declared dependency version; pnpm nested store artifact. ai
vendored-integrity unresolved-vendored-tree:lib/cjs/node_modules/.pnpm AI (vendored-integrity): pnpm store layout for declared @stellar/js-xdr dep, not an implant. ai
source-diff large-new-source-files AI (source-diff): Expected growth in active SDK monorepo, not injected code. ai
maintainer-change maintainer-removed AI (maintainer-change): Org-managed CI publisher; maintainer roster churn is expected, not a takeover. ai
source-diff encoded-string-file:dist/stellar-sdk-axios.js AI (source-diff): Base64 SAC XDR spec embedded in dist bundle; standard for this Stellar SDK package. ai
source-diff encoded-string-file:dist/stellar-sdk-axios.min.js AI (source-diff): Minified dist bundle containing same SAC XDR spec; stable false positive. ai
source-diff encoded-string-file:dist/stellar-sdk-no-eventsource.min.js AI (source-diff): Minified no-eventsource bundle containing SAC_SPEC constant. ai
source-diff obfuscated-file:lib/bindings/sac-spec.js AI (source-diff): Base64-encoded Soroban contract spec (SAC token ABI), not obfuscated code. ai
source-diff obfuscated-file:lib/minimal/bindings/sac-spec.js AI (source-diff): Same SAC spec data in minimal build variant. ai
source-diff obfuscated-file:lib/no-axios/bindings/sac-spec.js AI (source-diff): Same SAC spec data in no-axios build variant. ai
source-diff obfuscated-file:lib/no-eventsource/bindings/sac-spec.js AI (source-diff): Same SAC spec data in no-eventsource build variant. ai
source-diff encoded-string-file:dist/stellar-sdk-minimal.js AI (source-diff): SAC_SPEC constant in webpack bundle; contract ABI data, not a payload. ai
source-diff encoded-string-file:dist/stellar-sdk-minimal.min.js AI (source-diff): Minified bundle containing SAC_SPEC constant. ai
source-diff encoded-string-file:dist/stellar-sdk-no-axios.js AI (source-diff): SAC_SPEC constant in no-axios webpack bundle. ai
source-diff encoded-string-file:dist/stellar-sdk-no-axios.min.js AI (source-diff): Minified no-axios bundle containing SAC_SPEC constant. ai
source-diff encoded-string-file:dist/stellar-sdk-no-eventsource.js AI (source-diff): SAC_SPEC constant in no-eventsource webpack bundle. ai
source-diff encoded-string-file:dist/stellar-sdk.js AI (source-diff): SAC_SPEC constant in main webpack bundle. ai
source-diff encoded-string-file:dist/stellar-sdk.min.js AI (source-diff): Minified main bundle containing SAC_SPEC constant. ai
install-scripts install-script:postinstall AI (install-scripts): Postinstall runs 'yarn setup' which only sets git config; benign dev tooling, stable for this package. ai
dependencies unvetted-dep:urijs AI (dependencies): Standard URI manipulation library; legitimate dependency for URL handling in the Stellar SDK. ai
dependencies unvetted-dep:toml AI (dependencies): Standard TOML parser; legitimate dependency for configuration parsing in the Stellar SDK. ai
dependencies unvetted-dep:feaxios AI (dependencies): Lightweight fetch-based HTTP client used as axios alternative in browser environments; legitimate dependency for this SDK. ai
dependencies unvetted-dep:eventsource AI (dependencies): Standard EventSource polyfill used for streaming Stellar Horizon/Soroban RPC events; legitimate and expected dependency. ai
dependencies unvetted-dep:@stellar/stellar-base AI (dependencies): First-party companion library from the Stellar Development Foundation; always a legitimate dependency of this SDK. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding in this SDK is used for WASM hash validation and standard cryptographic operations — not obfuscation or payload hiding. Stable false positive for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding is used for signed auth entry handling in blockchain wallet interactions — standard cryptographic operation for a Stellar SDK, not malicious payload hiding. ai

Versions (showing 17 of 17)

Version Deps Published
16.1.0 12 / 46
16.0.1 12 / 46
16.0.0 12 / 46
15.1.0 9 / 58
15.0.1 9 / 58
15.0.0 9 / 58
14.6.1 9 / 58
14.6.0 9 / 58
14.5.0 9 / 58
14.4.3 8 / 57
14.4.2 8 / 57
14.4.1 8 / 57
14.4.0 8 / 57
14.3.3 8 / 57
14.3.2 8 / 57
14.3.1 7 / 58
14.2.0 8 / 68

v16.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v14.6.1

2 findings
HIGH Publisher changed: stellar-npm-ci → GitHub Actions (on 2026-03-04) provenance

This version was published by a different npm account than previous versions on 2026-03-04. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v14.6.0

2 findings
HIGH Publisher changed: stellar-npm-ci → GitHub Actions (on 2026-03-02) provenance

This version was published by a different npm account than previous versions on 2026-03-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v14.5.0

2 findings
HIGH Publisher changed: stellar-npm-ci → GitHub Actions (on 2026-01-27) provenance

This version was published by a different npm account than previous versions on 2026-01-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v14.4.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.4.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.