← Home

@walletconnect/utils

npm Repository Homepage

Utilities for WalletConnect Protocol

6
Versions
SEE LICENSE IN LICENSE.md
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

cyberdrkreown-npm-org

Keywords

walletwalletconnect

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:query-string AI (phantom-deps): Config-file reference, common false positive for this package. ai
dependencies unvetted-dep:elliptic AI (dependencies): Established crypto lib used for legit ECDSA in this package. ai
source-diff encoded-string-file:dist/index.umd.js AI (source-diff): Rollup UMD bundle output, not obfuscation. ai
source-diff encoded-string-file:dist/index.es.js AI (source-diff): Rollup bundle output, not obfuscation. ai
source-diff encoded-string-file:dist/index.cjs.js AI (source-diff): Rollup bundle output, not obfuscation; stable for this build pipeline. ai
maintainer-change maintainer-added AI (maintainer-change): Same handoff; stable across versions. ai
provenance publisher-changed AI (provenance): Legitimate maintainer transition on established WalletConnect org package; publisher has clean track record. ai
source-diff obfuscated-file:dist/index.js AI (source-diff): Standard Rollup bundle output; not obfuscated. Stable for this package. ai
source-diff obfuscated-file:dist/index.cjs AI (source-diff): Standard Rollup bundle output; not obfuscated. Stable for this package. ai
publish-pattern new-deps-added AI (publish-pattern): ox is a vetted Ethereum primitives lib replacing viem; not a suspicious addition for this package. ai
phantom-deps phantom-dep:@walletconnect/safe-json AI (phantom-deps): Same-org WalletConnect package; phantom finding reflects monorepo bundler config usage, not a real risk. ai
phantom-deps phantom-dep:@noble/ciphers AI (phantom-deps): @noble/ciphers is a reputable cryptography library; phantom finding reflects monorepo bundler config usage, not a real risk for this package. ai
phantom-deps phantom-dep:@noble/hashes AI (phantom-deps): @noble/hashes is a reputable cryptography library; phantom finding reflects monorepo bundler config usage, not a real risk for this package. ai
phantom-deps phantom-dep:@noble/curves AI (phantom-deps): @noble/curves is a reputable cryptography library; phantom finding reflects monorepo bundler config usage, not a real risk for this package. ai
bogus-package bogus-package AI (bogus-package): WalletConnect rebranded to Reown; new publisher account but same canonical monorepo with SLSA provenance. Inflated semver is continuation of existing version line. ai

Versions (showing 6 of 106)

Version Deps Published
2.1.4 15 / 1
2.1.3 15 / 1
2.1.2 15 / 1
2.1.1 15 / 1
2.1.0 15 / 1
2.0.0 15 / 1

v2.1.4

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gancho_walletconnect → bkrem (on 2022-11-25, known maintainer) provenance

This version was published by a different npm account (bkrem) than the most recent previously approved version (gancho_walletconnect) on 2022-11-25, but bkrem is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.1.3

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gancho_walletconnect → bkrem (on 2022-11-14, known maintainer) provenance

This version was published by a different npm account (bkrem) than the most recent previously approved version (gancho_walletconnect) on 2022-11-14, but bkrem is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.