← Home

@ton/ton

npm Repository Homepage
8
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

tsivarevklpxdanil42russiatolk-vmton-ciit-tonstudio-io

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:teslabot AI (phantom-deps): Compiled TypeScript package; dist files may use teslabot without direct source imports being detectable. Stable false positive for this package. ai
phantom-deps phantom-dep:symbol.inspect AI (phantom-deps): Compiled TypeScript package; symbol.inspect usage in dist may not be directly traceable to source imports. Stable false positive for this package. ai
typosquat typosquat.levenshtein:koa AI (typosquat): @ton/ton is the official TON blockchain SDK, not a typosquat of koa. The match is a coincidental Levenshtein distance on an unrelated brand name. ai
typosquat typosquat.levenshtein:got AI (typosquat): @ton/ton is the official TON blockchain SDK, not a typosquat of got. The match is a coincidental Levenshtein distance on an unrelated brand name. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @ton/ton is the official TON blockchain SDK, not a typosquat of joi. The match is a coincidental Levenshtein distance on an unrelated brand name. ai
typosquat typosquat.levenshtein:zod AI (typosquat): @ton/ton is the official TON blockchain SDK, not a typosquat of zod. The match is a coincidental Levenshtein distance on an unrelated brand name. ai

Versions (showing 8 of 8)

Version Deps Published
16.3.0 3 / 13
16.2.4 3 / 13
16.2.3 3 / 13
16.2.2 3 / 13
16.2.1 3 / 13
16.2.0 3 / 13
16.1.0 5 / 23
16.0.0 5 / 23

v16.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.2.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.2.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.