bcrypto
JS crypto library
6
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
chjj
Keywords
ciphercryptocryptographycurvedigestececcelliptichashhashing
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:bufio | AI (dependencies): bufio is a bcoin-org package published by the same author (chjj) as bcrypto; it is a trusted sibling dependency within the same ecosystem. | ai | |
| phantom-deps | phantom-dep:nan | AI (phantom-deps): nan is used by node-gyp for native addon compatibility; it is referenced in build config files as expected for a native C++ addon package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is a core utility in a cryptography library; no malicious payload hiding, just standard encoding operations. | ai | |
| typosquat | typosquat.levenshtein:bcryptjs | AI (typosquat): bcrypto is a distinct, well-established crypto library in the bcoin-org ecosystem, not a typosquat of bcryptjs. | ai | |
| typosquat | typosquat.levenshtein:bcrypt | AI (typosquat): bcrypto is a distinct, well-established crypto library in the bcoin-org ecosystem, not a typosquat of bcrypt. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is expected and legitimate in a cryptography library handling PEM/encoding formats; not indicative of malicious payloads. | ai | |
| install-scripts | install-script:install | AI (install-scripts): bcrypto is a native crypto addon; node-gyp rebuild is the standard and expected install script for building C bindings. | ai |