@unisat/wallet-background
Complete wallet background logic for UniSat wallet, cross-platform compatible
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:lib/index.js | AI (source-diff): Long hex strings are dummy Bitcoin script witnesses (all zeros), not encoded payloads. | ai | |
| source-diff | encoded-string-file:lib/index.mjs | AI (source-diff): Same dummy script witness hex constants in ESM build; benign by inspection. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): All hex-decode hits are Bitcoin script constants (PSBT witness data, script templates) — standard in a Bitcoin wallet library. | ai | |
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): Listed as runtime dep; may be used in ESM build output not directly traceable by static import analysis. | ai | |
| phantom-deps | phantom-dep:randomstring | AI (phantom-deps): Listed as runtime dep; phantom-dep heuristic may miss indirect or dynamic usage in bundled output. | ai | |
| phantom-deps | phantom-dep:compare-versions | AI (phantom-deps): Listed as runtime dep; phantom-dep heuristic may miss usage in bundled output. | ai |
v3.0.1
3 findingsModified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
3 findingsModified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.