@zilliqa-js/crypto

Core crypto utilities for signing/verification/hashing Zilliqa transactions.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
typosquat	typosquat.levenshtein:bcrypt	AI (typosquat): @zilliqa-js/crypto is the official Zilliqa SDK crypto package, scoped under @zilliqa-js. No impersonation of bcrypt; names are semantically unrelated and the scoped namespace makes typosquatting implausible.	ai	2026/04/21
dependencies	unvetted-dep:elliptic	AI (dependencies): elliptic is a standard, widely-used ECC library; expected dependency for a blockchain crypto utility package.	ai	2026/04/21
dependencies	unvetted-dep:hash.js	AI (dependencies): hash.js is a standard hashing library commonly used alongside elliptic; expected in a blockchain crypto package.	ai	2026/04/21
dependencies	unvetted-dep:hmac-drbg	AI (dependencies): hmac-drbg is a standard deterministic random bit generator used in ECC signing; expected in a blockchain crypto package.	ai	2026/04/21
dependencies	unvetted-dep:scrypt-js	AI (dependencies): scrypt-js is a standard scrypt key derivation library; expected in a crypto/wallet package for key derivation.	ai	2026/04/21

Version	Deps	Published
3.5.0	12 / 38	2023-12-06