@talismn/on-chain-id — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

0xkheopsalectalisman

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Migrated to GitHub Actions CI/CD with SLSA provenance; stable for this org's packages.	ai	2026/06/01
source-diff	source-size-dropped	AI (source-diff): Build output change in monorepo; no suspicious content.	ai	2026/06/01
publish-pattern	new-deps-added	AI (publish-pattern): New dep is @talismn/crypto, a first-party Talisman package; not a suspicious third-party addition.	ai	2026/05/31
provenance	no-provenance	AI (provenance): Talisman monorepo packages consistently lack provenance; stable false positive for this package family.	ai	2026/05/30
dependencies	unvetted-dep:@talismn/util	AI (dependencies): Same-org sibling package from TalismanSociety; consistent namespace and SLSA-attested publisher.	ai	2026/05/30
dependencies	unvetted-dep:@talismn/crypto	AI (dependencies): Same-org sibling package from TalismanSociety; consistent namespace and SLSA-attested publisher.	ai	2026/05/30
provenance	slsa-provenance	AI (provenance): Published via CI/CD with Sigstore attestation; strong supply chain integrity for this package.	ai	2026/05/26

Versions (showing 30 of 30)

Version	Deps	Published
0.2.10	4 / 2	2026-04-20
0.2.9	4 / 2	2026-04-03
0.2.8	4 / 2	2026-04-02
0.2.7	4 / 2	2026-03-26
0.2.6	4 / 2	2026-03-05
0.2.5	4 / 2	2026-02-12
0.2.4	4 / 7	2026-01-07
0.2.3	4 / 7	2025-12-23
0.2.2	4 / 7	2025-12-12
0.2.1	4 / 7	2025-12-02
0.2.0	4 / 7	2025-11-20
0.1.29	4 / 11	2025-10-31
0.1.28	4 / 11	2025-10-17
0.1.26	4 / 11	2025-10-01
0.1.23	4 / 11	2025-09-17
0.1.21	3 / 11	2025-08-08
0.1.20	3 / 11	2025-07-25
0.1.19	3 / 11	2025-07-18
0.1.18	3 / 11	2025-06-30
0.1.17	3 / 11	2025-06-11
0.1.16	3 / 11	2025-06-10
0.1.15	3 / 11	2025-06-05
0.1.14	3 / 11	2025-06-04
0.1.13	3 / 11	2025-05-29
0.1.12	3 / 11	2025-05-28
0.1.11	3 / 11	2025-05-19
0.1.10	3 / 11	2025-05-12
0.1.9	3 / 11	2025-05-09
0.1.8	3 / 11	2025-05-08
0.1.7	3 / 11	2025-05-01

v0.2.9

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.7

2 findings

HIGH Publisher changed: alectalisman → GitHub Actions (on 2026-03-26) provenance

This version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.29

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.17

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.