@xyo-network/xl1-protocol
XYO Layer One Protocol - All Protocol Packages
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): Consolidation of 4 removed dependencies into this package accounts for the size jump. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Explained by inlining of removed sibling packages' build output, not injected code. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): atrouw is a known maintainer matched by email; large approved track record confirms legitimacy. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): xyo removed as part of routine maintainer rotation within the same org; no takeover indicators. | ai | |
| provenance | publisher-changed | AI (provenance): joelbcarter is an established publisher (1813 approved) in the same org; transition appears legitimate. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard ArrayBuffer utility using Buffer.from for base64 decoding; not obfuscation. | ai | |
| dependencies | unvetted-dep:@xyo-network/module-events | AI (dependencies): Sibling package within the same @xyo-network org; stable false positive for this package family. | ai | |
| bogus-package | bogus-package | AI (bogus-package): XYO Network org consistently uses link-dump READMEs and omits keywords; not indicative of spam or phishing for this publisher. | ai | |
| provenance | no-provenance | AI (provenance): Established org package with strong publisher track record; provenance gap is a process concern, not a security block. | ai |
Versions (showing 51 of 565)
| Version | Deps | Published |
|---|---|---|
| 4.6.3 | 2 / 11 | |
| 4.6.2 | 2 / 11 | |
| 4.6.1 | 2 / 11 | |
| 4.6.0 | 2 / 11 | |
| 4.5.3 | 2 / 11 | |
| 4.5.2 | 2 / 11 | |
| 4.5.1 | 2 / 11 | |
| 4.5.0 | 2 / 11 | |
| 4.4.10 | 2 / 11 | |
| 4.4.9 | 2 / 11 | |
| 4.4.8 | 2 / 11 | |
| 4.4.7 | 2 / 11 | |
| 4.4.6 | 2 / 11 | |
| 4.4.5 | 0 / 13 | |
| 4.4.4 | 0 / 13 | |
| 4.4.3 | 0 / 13 | |
| 4.4.2 | 0 / 13 | |
| 4.4.1 | 0 / 13 | |
| 4.4.0 | 0 / 13 | |
| 4.3.3 | 0 / 13 | |
| 4.3.2 | 0 / 13 | |
| 4.3.1 | 0 / 13 | |
| 4.3.0 | 0 / 13 | |
| 4.2.3 | 0 / 13 | |
| 4.2.2 | 0 / 13 | |
| 4.2.1 | 0 / 13 | |
| 4.2.0 | 0 / 13 | |
| 4.1.6 | 0 / 13 | |
| 4.1.5 | 0 / 13 | |
| 4.1.4 | 0 / 13 | |
| 4.1.3 | 0 / 13 | |
| 4.1.2 | 0 / 13 | |
| 4.1.1 | 0 / 13 | |
| 4.0.14 | 0 / 26 | |
| 2.0.4 | 4 / 53 | |
| 1.26.41 | 4 / 57 | |
| 1.26.40 | 4 / 57 | |
| 1.26.38 | 4 / 57 | |
| 1.26.13 | 5 / 33 | |
| 1.26.12 | 5 / 17 | |
| 1.26.11 | 5 / 14 | |
| 1.26.10 | 5 / 14 | |
| 1.26.9 | 5 / 14 | |
| 1.26.8 | 5 / 14 | |
| 1.26.7 | 5 / 14 | |
| 1.26.6 | 5 / 14 | |
| 1.26.4 | 5 / 13 | |
| 1.26.3 | 5 / 13 | |
| 1.26.2 | 5 / 13 | |
| 1.26.1 | 5 / 13 | |
| 1.25.33 | 0 / 11 |
v4.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.9
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atrouw) than the most recent previously approved version (jonesmac) on 2026-07-17, but atrouw is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.4.8
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jonesmac) than the most recent previously approved version (atrouw) on 2026-07-17, but jonesmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.4.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.5
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (joelbcarter) than the most recent previously approved version (atrouw) on unknown date, but joelbcarter is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.4.4
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (joelbcarter) than the most recent previously approved version (atrouw) on unknown date, but joelbcarter is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.4.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atrouw) than the most recent previously approved version (joelbcarter) on 2026-07-16, but atrouw is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.4.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (joelbcarter) than the most recent previously approved version (atrouw) on 2026-07-16, but joelbcarter is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atrouw) than the most recent previously approved version (jonesmac) on 2026-07-15, but atrouw is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.3.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jonesmac) than the most recent previously approved version (atrouw) on 2026-07-15, but jonesmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atrouw) than the most recent previously approved version (joelbcarter) on 2026-07-14, but atrouw is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (joelbcarter) than the most recent previously approved version (atrouw) on 2026-07-14, but joelbcarter is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v4.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atrouw.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.14
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atrouw.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.