← Home

@x402/extensions

npm Repository
23
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

carsonroscoe_cberik_cb

Keywords

x402paymentprotocolextensions

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Stub/placeholder package at v0.0.1 from Coinbase's x402 protocol ecosystem. Tiny payload and minimal metadata are expected for an early-stage extensions namespace package. ai
provenance no-provenance AI (provenance): Coinbase-published package with legitimate repo; lack of Sigstore provenance is common and not a risk signal given the publisher's track record. ai
dependencies unvetted-dep:jose AI (dependencies): jose is a well-established, widely-used JWT/JWK library with millions of weekly downloads; not a risk for this package. ai
dependencies unvetted-dep:viem AI (dependencies): viem is a canonical Ethereum TypeScript library with broad ecosystem adoption; appropriate dependency for a payment protocol package. ai
dependencies unvetted-dep:@signinwithethereum/siwe AI (dependencies): Sign-In with Ethereum (SIWE) is the canonical EIP-4361 implementation; legitimate dependency for a Web3 extensions package. ai
dependencies unvetted-dep:@x402/core AI (dependencies): Sibling package from the same x402 Foundation org; expected internal dependency for the x402 protocol ecosystem. ai

Versions (showing 23 of 23)

Version Deps Published
2.20.0 9 / 15
2.19.0 9 / 15
2.18.0 9 / 15
2.17.0 9 / 15
2.16.0 9 / 15
2.15.0 9 / 15
2.14.0 9 / 15
2.13.0 9 / 15
2.12.0 9 / 15
2.11.0 9 / 15
2.10.0 9 / 15
2.9.0 9 / 15
2.8.0 9 / 15
2.7.0 9 / 15
2.6.0 7 / 15
2.5.0 7 / 15
2.4.0 7 / 15
2.3.1 7 / 15
2.3.0 7 / 15
2.2.0 3 / 15
2.1.0 3 / 15
2.0.0 3 / 15
0.0.1 0 / 0

v2.20.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.19.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.