@walletconnect/core
Core for WalletConnect Protocol
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@walletconnect/relay-api | AI (phantom-deps): Same-org dep, expected type-only or transitive usage. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): Logger formatting dep, plausibly used conditionally; benign for this package. | ai | |
| phantom-deps | phantom-dep:uint8arrays | AI (phantom-deps): Common byte-array util, likely used in bundled/minified code. | ai | |
| phantom-deps | phantom-dep:@walletconnect/jsonrpc-types | AI (phantom-deps): Same-org type dep, transitively used; stable FP. | ai | |
| source-diff | encoded-string-file:dist/index.umd.js | AI (source-diff): Rollup UMD bundle output; long strings are normal minified dist. | ai | |
| source-diff | obfuscated-file:dist/index.cjs | AI (source-diff): Rollup-bundled CJS output; standard minification for this package. | ai | |
| phantom-deps | phantom-dep:es-toolkit | AI (phantom-deps): Declared dep consumed inside the bundle; not a direct import but used at runtime. | ai | |
| source-diff | obfuscated-file:dist/index.js | AI (source-diff): Rollup-bundled ESM output; standard minification for this package. | ai | |
| dependencies | unvetted-dep:@walletconnect/jsonrpc-utils | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| dependencies | unvetted-dep:@walletconnect/window-getters | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @walletconnect/core is the legitimate WalletConnect core package in a scoped namespace; Levenshtein comparison to 'cors' is a false positive with no impersonation intent. | ai | |
| dependencies | unvetted-dep:@walletconnect/jsonrpc-ws-connection | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| dependencies | unvetted-dep:@walletconnect/jsonrpc-provider | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Inflated semver is expected for a monorepo package versioned in lockstep; short README is typical for ecosystem sub-packages. Not indicative of spam or malice. | ai | |
| dependencies | unvetted-dep:es-toolkit | AI (dependencies): es-toolkit is a well-known utility library; its use here is legitimate. | ai | |
| dependencies | unvetted-dep:uint8arrays | AI (dependencies): uint8arrays is a standard utility for binary data in the JS/IPFS ecosystem; legitimate dependency. | ai | |
| dependencies | unvetted-dep:@walletconnect/time | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| dependencies | unvetted-dep:@walletconnect/relay-api | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| dependencies | unvetted-dep:@walletconnect/safe-json | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai | |
| dependencies | unvetted-dep:@walletconnect/relay-auth | AI (dependencies): Part of the WalletConnect monorepo ecosystem; expected sub-package dependency. | ai |
Versions (showing 18 of 118)
| Version | Deps | Published |
|---|---|---|
| 2.4.4 | 16 / 1 | |
| 2.4.3 | 16 / 1 | |
| 2.4.2 | 16 / 1 | |
| 2.4.1 | 16 / 1 | |
| 2.4.0 | 16 / 1 | |
| 2.3.3 | 16 / 1 | |
| 2.3.2 | 16 / 1 | |
| 2.3.1 | 16 / 1 | |
| 2.3.0 | 16 / 1 | |
| 2.2.1 | 16 / 1 | |
| 2.2.0 | 16 / 1 | |
| 2.1.5 | 16 / 1 | |
| 2.1.4 | 16 / 1 | |
| 2.1.3 | 15 / 1 | |
| 2.1.2 | 14 / 1 | |
| 2.1.1 | 16 / 1 | |
| 2.1.0 | 16 / 1 | |
| 2.0.0 | 16 / 1 |
v2.4.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.3.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.