← Home

@x402/evm

npm Repository
22
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

carsonroscoe_cberik_cb

Keywords

x402paymentprotocolevmethereum

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Package is a minimal stub/scaffold in the Coinbase x402 monorepo. Tiny payload and no deps are expected for this early-stage protocol package, not spam indicators. ai
provenance no-provenance AI (provenance): Coinbase-authored package in a legitimate monorepo; lack of Sigstore provenance is common and not a meaningful risk signal here. ai
provenance slsa-provenance AI (provenance): Package consistently published via GitHub Actions CI/CD with Sigstore attestation from the x402-foundation org. This is a stable, positive signal for this package. ai

Versions (showing 22 of 22)

Version Deps Published
2.19.0 3 / 15
2.18.0 3 / 15
2.17.0 3 / 15
2.16.0 3 / 15
2.15.0 3 / 15
2.14.0 3 / 15
2.13.0 3 / 15
2.12.0 3 / 15
2.11.0 3 / 15
2.10.0 3 / 15
2.9.0 3 / 15
2.8.0 3 / 15
2.7.0 3 / 15
2.6.0 4 / 15
2.5.0 4 / 15
2.4.0 4 / 15
2.3.1 3 / 15
2.3.0 3 / 15
2.2.0 3 / 15
2.1.0 3 / 15
2.0.0 3 / 15
0.0.1 0 / 0

v2.19.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.