@tronweb3/tronwallet-adapters No license 34 versions

@tronweb3/tronwallet-adapters

npm Repository Homepage

34

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

troncoretronwallet-adapter

Keywords

TRONTronWebadapters

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@tronweb3/tronwallet-adapter-ledger-evm	AI (dependencies): First-party sibling package in same monorepo/org, matches package's aggregator purpose.	ai	2026/07/14
provenance	publisher-changed	AI (provenance): Trusted publisher with strong track record; org-internal maintainer transition.	ai	2026/07/13
maintainer-change	maintainer-added	AI (maintainer-change): Same org transition, no behavioral compromise evidence.	ai	2026/07/13
maintainer-change	maintainer-removed	AI (maintainer-change): Consistent with legitimate handoff given publisher's clean history.	ai	2026/07/13
semgrep	semgrep:base64-decode	AI (semgrep): Base64 usage in bundled wallet adapter is standard encoding for address/signing operations, not payload obfuscation.	ai	2026/05/11
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding is standard cryptographic/address handling in a blockchain wallet adapter.	ai	2026/05/11
source-diff	encoded-string-file:lib/umd/index.js	AI (source-diff): Encoded string is the documented ENS normalize compressed data blob with cited SHA-256; not malicious.	ai	2026/05/11
source-diff	encoded-string-file:lib/umd/index.min.js	AI (source-diff): Minified bundle containing same ENS/crypto utility code; no obfuscation or malicious payload.	ai	2026/05/11

Versions (showing 34 of 34)

Version	Deps	Published
1.3.1	22 / 3	2026-07-10
1.3.0	22 / 3	2026-06-11
1.2.26	22 / 3	2026-05-15
1.2.25	21 / 3	2026-04-23
1.2.24	20 / 3	2026-04-09
1.2.23	19 / 3	2026-03-25
1.2.22	18 / 5	2026-03-11
1.2.21	18 / 5	2026-02-10
1.2.20	18 / 5	2026-01-26
1.2.19	18 / 5	2026-01-16
1.2.18	17 / 5	2026-01-07
1.2.17	14 / 5	2025-12-26
1.2.16	14 / 5	2025-11-19
1.2.15	14 / 6	2025-10-24
1.2.14	14 / 6	2025-09-25
1.2.13	13 / 6	2025-09-05
1.2.12	13 / 6	2025-07-22
1.2.11	13 / 6	2025-07-10
1.2.10	12 / 6	2025-07-09
1.2.9	11 / 6	2025-05-27
1.2.8	10 / 6	2025-03-25
1.2.4	8 / 6	2024-09-30
1.2.3	7 / 6	2024-09-24
1.2.2	6 / 1	2024-07-16
1.1.8	6 / 1	2023-09-19
1.1.7	6 / 1	2023-08-10
1.1.6	6 / 1	2023-06-20
1.1.5	6 / 1	2023-05-05
1.1.4	3 / 1	2023-03-23
1.1.3	3 / 1	2023-03-01
1.1.2	3 / 1	2023-02-20
1.1.1	3 / 1	2023-02-06
1.1.0	3 / 1	2023-01-17
1.0.0	3 / 1	2022-12-28

v1.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.8

2 findings

HIGH Publisher changed: troncore → tronwallet-adapter (on 2025-03-25) provenance

This version was published by a different npm account than previous versions on 2025-03-25. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.2

2 findings

MEDIUM Publisher changed: tron-dev → troncore (on 2023-02-20, unremoved on npm for 1253d) provenance

This version was published by a different npm account (troncore) than the most recent previously approved version (tron-dev) on 2023-02-20. It has since remained available on npm for 1253 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

2 findings

MEDIUM Publisher changed: tron-dev → troncore (on 2023-02-06, unremoved on npm for 1267d) provenance

This version was published by a different npm account (troncore) than the most recent previously approved version (tron-dev) on 2023-02-06. It has since remained available on npm for 1267 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.