← Home

@zero-transfer/core

npm Repository Homepage

Provider-neutral contracts, transfer engine, queue, profiles, and errors.

6
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

molex222

Keywords

zero-transfercorecoretransfer-clientsdk

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/index.d.mts AI (source-diff): File is a bundled TypeScript declaration rollup; long lines are expected, not obfuscation. ai
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped package @zero-transfer/core; 'core' substring match to 'cors' is a false positive, not a typosquat attempt. ai

Versions (showing 6 of 6)

Version Deps Published
0.1.6 0 / 0
0.1.5 0 / 0
0.1.4 0 / 0
0.1.3 0 / 0
0.1.2 0 / 0
0.1.1 0 / 0

v0.1.6

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@zero-transfer/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.5

2 findings
HIGH New obfuscated file: dist/index.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.