← Home

@swapkit/toolboxes

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

chilliostowan

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/src/aleo/index.cjs AI (source-diff): Bundled/minified build output for new chain module, not true obfuscation. ai
source-diff obfuscated-file:dist/src/aleo/index.js AI (source-diff): Bundled/minified build output for new chain module, not true obfuscation. ai
dependencies unvetted-dep:@meshsdk/core AI (dependencies): Official Cardano Mesh SDK; matches new cardano toolbox export in this package. ai
dependencies unvetted-dep:near-sdk-js AI (dependencies): Legitimate NEAR blockchain SDK; expected dependency for a multi-chain toolbox. ai
dependencies unvetted-dep:@psf/bitcoincashjs-lib AI (dependencies): Bitcoin Cash library; consistent with UTXO toolbox functionality in this package. ai
semgrep semgrep:hex-decode AI (semgrep): Hex decoding used for standard Bitcoin UTXO script construction; not obfuscation. ai
phantom-deps phantom-dep:@noble/hashes AI (phantom-deps): Same bundled toolbox pattern; stable false positive for this package. ai
phantom-deps phantom-dep:near-api-js AI (phantom-deps): Bundled multi-chain toolbox; declared deps may not be directly imported in analyzed entry points. ai
dependencies unvetted-dep:@near-js/accounts AI (dependencies): Official NEAR protocol SDK; expected dep for a multi-chain toolbox with a /near export. ai
dependencies unvetted-dep:starknet AI (dependencies): Legitimate StarkNet SDK; expected dep for a multi-chain toolbox with a /starknet export. ai
phantom-deps phantom-dep:@mysten/bcs AI (phantom-deps): @mysten/bcs is listed in both runtime and devDependencies; phantom-dep is a false positive here. ai

Versions (showing 51 of 91)

View all versions
Version Deps Published
4.28.0 2 / 52
4.27.1 2 / 52
4.27.0 2 / 52
4.26.1 2 / 52
4.26.0 2 / 52
4.25.0 2 / 52
4.24.1 2 / 51
4.23.1 2 / 51
4.23.0 2 / 51
4.22.0 2 / 51
4.21.0 2 / 51
4.20.2 2 / 51
4.20.1 2 / 51
4.20.0 2 / 51
4.19.0 2 / 50
4.18.0 2 / 50
4.17.6 2 / 50
4.17.5 2 / 50
4.17.4 2 / 50
4.17.3 2 / 50
4.17.2 2 / 50
4.17.1 2 / 50
4.17.0 2 / 50
4.16.2 2 / 49
4.16.1 2 / 49
4.16.0 2 / 49
4.15.15 2 / 49
4.15.14 2 / 49
4.15.13 2 / 49
4.15.12 2 / 50
4.15.11 2 / 50
4.15.10 46 / 49
4.15.9 46 / 49
4.15.8 46 / 49
4.15.7 46 / 49
4.15.6 46 / 49
4.15.5 46 / 49
4.15.4 46 / 49
4.15.3 46 / 49
4.15.2 46 / 49
4.15.1 46 / 49
4.15.0 46 / 49
4.14.5 46 / 49
4.14.4 46 / 49
4.14.3 46 / 49
4.14.2 46 / 49
4.14.1 46 / 49
4.14.0 46 / 49
4.13.3 46 / 49
4.13.2 46 / 49
4.13.1 46 / 49

v4.28.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.27.1

3 findings
HIGH New obfuscated file: dist/src/aleo/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/src/aleo/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.27.0

3 findings
HIGH New obfuscated file: dist/src/aleo/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/src/aleo/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.26.1

3 findings
HIGH New obfuscated file: dist/src/aleo/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/src/aleo/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.26.0

3 findings
HIGH New obfuscated file: dist/src/aleo/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/src/aleo/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.25.0

3 findings
HIGH New obfuscated file: dist/src/aleo/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/src/aleo/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.24.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.23.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.23.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.22.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.21.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.20.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.20.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.20.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.