@walletconnect/utils — Greenflagged

Utilities for WalletConnect Protocol

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

cyberdrkreown-npm-org

Keywords

walletwalletconnect

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:query-string	AI (phantom-deps): Config-file reference, common false positive for this package.	ai	2026/07/08
dependencies	unvetted-dep:elliptic	AI (dependencies): Established crypto lib used for legit ECDSA in this package.	ai	2026/07/08
source-diff	encoded-string-file:dist/index.umd.js	AI (source-diff): Rollup UMD bundle output, not obfuscation.	ai	2026/07/08
source-diff	encoded-string-file:dist/index.es.js	AI (source-diff): Rollup bundle output, not obfuscation.	ai	2026/07/08
source-diff	encoded-string-file:dist/index.cjs.js	AI (source-diff): Rollup bundle output, not obfuscation; stable for this build pipeline.	ai	2026/07/08
maintainer-change	maintainer-added	AI (maintainer-change): Same handoff; stable across versions.	ai	2026/07/08
provenance	publisher-changed	AI (provenance): Legitimate maintainer transition on established WalletConnect org package; publisher has clean track record.	ai	2026/07/08
source-diff	obfuscated-file:dist/index.js	AI (source-diff): Standard Rollup bundle output; not obfuscated. Stable for this package.	ai	2026/05/09
source-diff	obfuscated-file:dist/index.cjs	AI (source-diff): Standard Rollup bundle output; not obfuscated. Stable for this package.	ai	2026/05/09
publish-pattern	new-deps-added	AI (publish-pattern): ox is a vetted Ethereum primitives lib replacing viem; not a suspicious addition for this package.	ai	2026/05/09
phantom-deps	phantom-dep:@walletconnect/safe-json	AI (phantom-deps): Same-org WalletConnect package; phantom finding reflects monorepo bundler config usage, not a real risk.	ai	2026/04/26
phantom-deps	phantom-dep:@noble/ciphers	AI (phantom-deps): @noble/ciphers is a reputable cryptography library; phantom finding reflects monorepo bundler config usage, not a real risk for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@noble/hashes	AI (phantom-deps): @noble/hashes is a reputable cryptography library; phantom finding reflects monorepo bundler config usage, not a real risk for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@noble/curves	AI (phantom-deps): @noble/curves is a reputable cryptography library; phantom finding reflects monorepo bundler config usage, not a real risk for this package.	ai	2026/04/26
bogus-package	bogus-package	AI (bogus-package): WalletConnect rebranded to Reown; new publisher account but same canonical monorepo with SLSA provenance. Inflated semver is continuation of existing version line.	ai	2026/04/21

Versions (showing 51 of 106)

View all versions

Version	Deps	Published
2.23.10	19 / 2	2026-06-24
2.23.9	19 / 2	2026-03-27
2.23.8	19 / 2	2026-03-10
2.23.7	19 / 2	2026-02-27
2.23.6	19 / 2	2026-02-18
2.23.5	19 / 2	2026-02-11
2.23.4	20 / 2	2026-01-21
2.23.3	20 / 2	2026-01-14
2.23.2	20 / 2	2026-01-13
2.23.1	20 / 2	2025-12-11
2.23.0	20 / 2	2025-10-30
2.22.4	20 / 2	2025-10-14
2.22.3	20 / 2	2025-10-11
2.22.2	20 / 2	2025-10-08
2.22.1	19 / 2	2025-10-08
2.22.0	19 / 2	2025-10-08
2.21.10	19 / 2	2025-09-30
2.21.9	19 / 2	2025-09-18
2.21.8	20 / 2	2025-08-11
2.21.7	20 / 2	2025-08-07
2.21.6	20 / 2	2025-07-31
2.21.5	20 / 2	2025-07-17
2.21.4	20 / 2	2025-06-25
2.21.3	20 / 2	2025-06-16
2.21.2	20 / 2	2025-06-09
2.21.1	17 / 2	2025-06-03
2.21.0	17 / 2	2025-05-29
2.20.3	17 / 2	2025-05-20
2.20.2	17 / 2	2025-05-01
2.20.1	17 / 2	2025-05-01
2.20.0	17 / 2	2025-04-15
2.19.4	17 / 2	2025-04-15
2.19.3	17 / 2	2025-04-15
2.19.2	17 / 2	2025-03-26
2.18.0	17 / 4	2025-01-29
2.16.3	16 / 2	2024-09-30
2.16.2	16 / 2	2024-09-18
2.15.1	14 / 1	2024-08-20
2.14.0	14 / 1	2024-07-18
2.13.3	14 / 1	2024-06-14
2.13.2	14 / 1	2024-06-10
2.13.1	14 / 1	2024-05-29
2.13.0	14 / 1	2024-05-08
2.12.2	14 / 1	2024-04-10
2.12.1	14 / 1	2024-04-05
2.12.0	14 / 1	2024-04-03
2.11.3	14 / 1	2024-03-19
2.11.2	14 / 1	2024-02-22
2.11.1	14 / 1	2024-02-06
2.11.0	14 / 1	2023-12-21
2.10.6	14 / 1	2023-11-30

v2.20.0

2 findings

HIGH Publisher changed: gancho_walletconnect → reown-npm-org (on 2025-04-15) provenance

This version was published by a different npm account than previous versions on 2025-04-15. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.19.4

2 findings

HIGH Publisher changed: gancho_walletconnect → reown-npm-org (on 2025-04-15) provenance

This version was published by a different npm account than previous versions on 2025-04-15. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.19.3

2 findings

HIGH Publisher changed: gancho_walletconnect → reown-npm-org (on 2025-04-15) provenance

This version was published by a different npm account than previous versions on 2025-04-15. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.19.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: bkrem → gancho_walletconnect (on 2025-03-26, known maintainer) provenance

This version was published by a different npm account (gancho_walletconnect) than the most recent previously approved version (bkrem) on 2025-03-26, but gancho_walletconnect is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.18.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: bkrem → gancho_walletconnect (on 2025-01-29, known maintainer) provenance

This version was published by a different npm account (gancho_walletconnect) than the most recent previously approved version (bkrem) on 2025-01-29, but gancho_walletconnect is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.16.3

5 findings

HIGH Long encoded string in modified file: dist/index.cjs.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.es.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.umd.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: bkrem → gancho_walletconnect (on 2024-09-30, known maintainer) provenance

This version was published by a different npm account (gancho_walletconnect) than the most recent previously approved version (bkrem) on 2024-09-30, but gancho_walletconnect is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.16.2

5 findings

HIGH Long encoded string in modified file: dist/index.cjs.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.es.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.umd.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: bkrem → gancho_walletconnect (on 2024-09-18, known maintainer) provenance

This version was published by a different npm account (gancho_walletconnect) than the most recent previously approved version (bkrem) on 2024-09-18, but gancho_walletconnect is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.15.1

5 findings

HIGH Long encoded string in modified file: dist/index.cjs.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.es.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.umd.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: bkrem → gancho_walletconnect (on 2024-08-20, known maintainer) provenance

This version was published by a different npm account (gancho_walletconnect) than the most recent previously approved version (bkrem) on 2024-08-20, but gancho_walletconnect is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.14.0

5 findings

HIGH Long encoded string in modified file: dist/index.cjs.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.es.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.umd.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: bkrem → gancho_walletconnect (on 2024-07-18, known maintainer) provenance

This version was published by a different npm account (gancho_walletconnect) than the most recent previously approved version (bkrem) on 2024-07-18, but gancho_walletconnect is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.13.3

2 findings

HIGH Publisher changed: bkrem → lukaisailovic (on 2024-06-14) provenance

This version was published by a different npm account than previous versions on 2024-06-14. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gancho_walletconnect → bkrem (on 2024-06-10, known maintainer) provenance

This version was published by a different npm account (bkrem) than the most recent previously approved version (gancho_walletconnect) on 2024-06-10, but bkrem is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.12.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.