@wireio/stake
LIQ Staking Module for Wire Network
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:lib/stake.m.js | AI (source-diff): Long hex strings are EVM smart contract bytecodes embedded alongside Solidity ABIs — standard for blockchain SDKs that deploy/interact with contracts. | ai | |
| source-diff | encoded-string-file:lib/stake.js | AI (source-diff): Long hex strings are EVM smart contract bytecodes embedded alongside Solidity ABIs — standard for blockchain SDKs that deploy/interact with contracts. | ai | |
| source-diff | encoded-string-file:lib/stake.browser.js | AI (source-diff): Long hex strings are EVM smart contract bytecodes embedded alongside Solidity ABIs — standard for blockchain SDKs that deploy/interact with contracts. | ai | |
| dependencies | unvetted-dep:@sqds/multisig | AI (dependencies): @sqds/multisig is the Squads Protocol multisig SDK, a well-known Solana library. Expected dependency for a Solana staking SDK. | ai | |
| dependencies | unvetted-dep:@coral-xyz/anchor | AI (dependencies): @coral-xyz/anchor is the official Anchor framework for Solana development, a well-established and widely-used library. Not a real risk for this blockchain SDK package. | ai | |
| phantom-deps | phantom-dep:bs58 | AI (phantom-deps): bs58 is declared in package.json dependencies and is a standard base58 encoding library used in blockchain/Solana contexts. Phantom-dep flag is a false positive here. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit runtime dependency for TypeScript-compiled packages; phantom detection is a false positive here. | ai | |
| phantom-deps | phantom-dep:buffer | AI (phantom-deps): buffer is referenced in rollup polyfill config for browser bundling; not a direct import but a legitimate build-time polyfill declaration. | ai | |
| phantom-deps | phantom-dep:stream-browserify | AI (phantom-deps): stream-browserify is a standard browser polyfill for Node's stream module; referenced in rollup config, not a direct import. | ai | |
| phantom-deps | phantom-dep:crypto-browserify | AI (phantom-deps): crypto-browserify is a standard browser polyfill for Node's crypto module; referenced in rollup config, not a direct import. | ai | |
| phantom-deps | phantom-dep:web3-utils | AI (phantom-deps): web3-utils referenced in build config for browser bundle polyfills; standard pattern for Web3 SDK packages targeting browser environments. | ai | |
| phantom-deps | phantom-dep:@ethereumjs/tx | AI (phantom-deps): Referenced in build config for browser bundle; legitimate dependency for Ethereum transaction handling in a staking SDK. | ai |
Versions (showing 51 of 70)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 13 / 38 | |
| 2.7.4 | 13 / 38 | |
| 2.7.3 | 13 / 38 | |
| 2.7.2 | 13 / 38 | |
| 2.7.1 | 13 / 38 | |
| 2.7.0 | 13 / 38 | |
| 2.6.1 | 13 / 38 | |
| 2.6.0 | 13 / 38 | |
| 2.5.2 | 13 / 38 | |
| 2.5.1 | 13 / 38 | |
| 2.5.0 | 13 / 38 | |
| 2.4.4 | 13 / 38 | |
| 2.4.3 | 13 / 38 | |
| 2.4.2 | 13 / 38 | |
| 2.4.1 | 13 / 38 | |
| 2.4.0 | 13 / 38 | |
| 2.3.1 | 13 / 38 | |
| 2.3.0 | 13 / 38 | |
| 2.2.2 | 13 / 38 | |
| 2.2.1 | 13 / 38 | |
| 2.1.1 | 13 / 38 | |
| 2.1.0 | 13 / 38 | |
| 2.0.0 | 13 / 38 | |
| 1.11.69 | 13 / 38 | |
| 1.10.69 | 13 / 38 | |
| 1.9.69 | 13 / 38 | |
| 1.8.69 | 13 / 38 | |
| 1.7.69 | 13 / 38 | |
| 1.6.69 | 13 / 38 | |
| 1.5.69 | 13 / 38 | |
| 1.4.69 | 13 / 38 | |
| 1.3.69 | 13 / 38 | |
| 1.2.69 | 13 / 38 | |
| 1.1.69 | 13 / 38 | |
| 1.1.0 | 12 / 38 | |
| 1.0.69 | 13 / 38 | |
| 1.0.1 | 12 / 38 | |
| 1.0.0 | 12 / 38 | |
| 0.9.2 | 13 / 38 | |
| 0.9.1 | 13 / 38 | |
| 0.9.0 | 12 / 38 | |
| 0.7.3 | 12 / 38 | |
| 0.7.2 | 12 / 38 | |
| 0.7.1 | 12 / 38 | |
| 0.7.0 | 12 / 38 | |
| 0.6.69 | 13 / 38 | |
| 0.6.0 | 12 / 38 | |
| 0.5.2 | 12 / 38 | |
| 0.5.1 | 12 / 38 | |
| 0.5.0 | 12 / 38 | |
| 0.4.69 | 13 / 38 |
v3.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.