@cosmjs/crypto
Cryptography resources for blockchain projects
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:elliptic | AI (dependencies): Elliptic is a standard ECDSA library; appropriate for crypto package and widely used in blockchain projects. | ai | |
| phantom-deps | phantom-dep:@cosmjs/utils | AI (phantom-deps): Same-org scoped dependency (@cosmjs/utils) declared in package.json; phantom flag is a false positive for this monorepo package structure. | ai | |
| source-diff | encoded-string-file:build/hmac.spec.js | AI (source-diff): Long hex strings are RFC 4231 HMAC test vectors — standard cryptographic test data, not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:build/libsodium.spec.js | AI (source-diff): Long hex strings are Argon2/libsodium test vectors — standard cryptographic test data, not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:build/secp256k1.spec.js | AI (source-diff): Long hex strings are secp256k1 signature verification test vectors — standard cryptographic test data, not obfuscated payloads. | ai | |
| dependencies | unvetted-dep:hash-wasm | AI (dependencies): hash-wasm is a legitimate WebAssembly hashing library; its use in a cryptography package is expected and appropriate across all versions. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Minor metadata signals (README format, keywords) do not reflect actual code quality or security risk for established library. | ai | |
| typosquat | typosquat.levenshtein:bcrypt | AI (typosquat): @cosmjs/crypto is a scoped package from the established CosmWasm org; no impersonation intent. False positive for legitimate namespace. | ai | |
| dependencies | unvetted-dep:@cosmjs/encoding | AI (dependencies): Sibling package in the same CosmJS monorepo; legitimate dependency, not suspicious. | ai |
Versions (showing 40 of 40)
| Version | Deps | Published |
|---|---|---|
| 0.38.1 | 8 / 22 | |
| 0.38.0 | 8 / 22 | |
| 0.37.1 | 8 / 22 | |
| 0.37.0 | 8 / 22 | |
| 0.36.2 | 7 / 24 | |
| 0.36.1 | 7 / 24 | |
| 0.36.0 | 7 / 24 | |
| 0.35.2 | 6 / 24 | |
| 0.35.1 | 6 / 24 | |
| 0.35.0 | 6 / 24 | |
| 0.34.1 | 7 / 27 | |
| 0.34.0 | 7 / 27 | |
| 0.33.1 | 7 / 37 | |
| 0.33.0 | 7 / 37 | |
| 0.32.1 | 7 / 37 | |
| 0.31.1 | 7 / 37 | |
| 0.31.0 | 7 / 37 | |
| 0.30.1 | 7 / 37 | |
| 0.29.4 | 7 / 37 | |
| 0.29.0 | 7 / 37 | |
| 0.28.13 | 7 / 37 | |
| 0.28.9 | 7 / 37 | |
| 0.28.5 | 7 / 37 | |
| 0.28.3 | 7 / 38 | |
| 0.28.0 | 7 / 38 | |
| 0.26.5 | 10 / 41 | |
| 0.26.4 | 10 / 41 | |
| 0.26.3 | 10 / 41 | |
| 0.26.2 | 10 / 41 | |
| 0.26.1 | 10 / 41 | |
| 0.25.4 | 10 / 5 | |
| 0.25.3 | 10 / 5 | |
| 0.25.2 | 12 / 7 | |
| 0.25.0 | 12 / 7 | |
| 0.24.1 | 12 / 7 | |
| 0.24.0 | 12 / 7 | |
| 0.23.2 | 13 / 7 | |
| 0.21.1 | 13 / 7 | |
| 0.21.0 | 13 / 7 | |
| 0.20.1 | 13 / 7 |
v0.37.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.