@cosmjs/stargate
Utilities for Cosmos SDK 0.40
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-dropped | AI (source-diff): Size reduction is explained by migration of protobuf type definitions to the cosmjs-types package, removing previously bundled generated code. | ai | |
| source-diff | encoded-string-file:build/accounts.spec.js | AI (source-diff): The encoded string is a base64-encoded protobuf test fixture for a Cosmos vesting account — standard practice in CosmJS test files, not a malicious payload. | ai | |
| dependencies | unvetted-dep:@confio/ics23 | AI (dependencies): @confio/ics23 is the standard ICS-23 proof verification library for the Cosmos ecosystem; a legitimate and expected dependency for cosmjs/stargate. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from webmaster128 to willclarktech occurred in 2021 and is a legitimate CosmJS team transition. willclarktech has 287 approved packages and 0 rejections. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @cosmjs/amino is a first-party CosmJS monorepo package, not a suspicious third-party dep. This is a stable internal refactoring pattern for this package. | ai | |
| phantom-deps | phantom-dep:protobufjs | AI (phantom-deps): protobufjs is a declared runtime dependency used for protobuf serialization; referenced in build configs. Legitimate dependency for a Cosmos SDK package. | ai | |
| phantom-deps | phantom-dep:xstream | AI (phantom-deps): xstream is a declared runtime dependency used indirectly via build/config tooling in this Cosmos SDK utility package; not a real phantom dep concern. | ai | |
| provenance | no-provenance | AI (provenance): CosmJS is a legitimate, established project; lack of Sigstore provenance is common and not a risk signal for this package. | ai | |
| phantom-deps | phantom-dep:@cosmjs/stream | AI (phantom-deps): @cosmjs/stream is a sibling package in the same CosmJS monorepo; phantom-dep detection is a false positive for monorepo re-export patterns. | ai |
Versions (showing 51 of 60)
| Version | Deps | Published |
|---|---|---|
| 0.39.0 | 8 / 24 | |
| 0.38.1 | 8 / 24 | |
| 0.38.0 | 8 / 24 | |
| 0.37.1 | 8 / 24 | |
| 0.37.0 | 8 / 24 | |
| 0.36.2 | 8 / 25 | |
| 0.36.1 | 8 / 25 | |
| 0.36.0 | 8 / 25 | |
| 0.35.2 | 8 / 25 | |
| 0.35.1 | 8 / 25 | |
| 0.35.0 | 8 / 25 | |
| 0.34.1 | 8 / 27 | |
| 0.34.0 | 8 / 27 | |
| 0.33.1 | 8 / 36 | |
| 0.33.0 | 8 / 36 | |
| 0.32.4 | 10 / 36 | |
| 0.32.3 | 10 / 36 | |
| 0.32.2 | 10 / 36 | |
| 0.32.1 | 10 / 36 | |
| 0.32.0 | 10 / 36 | |
| 0.31.3 | 12 / 36 | |
| 0.31.2 | 12 / 36 | |
| 0.31.1 | 12 / 36 | |
| 0.31.0 | 12 / 36 | |
| 0.30.1 | 12 / 36 | |
| 0.30.0 | 12 / 36 | |
| 0.29.5 | 12 / 36 | |
| 0.29.4 | 12 / 36 | |
| 0.29.3 | 12 / 36 | |
| 0.29.2 | 12 / 36 | |
| 0.29.1 | 12 / 36 | |
| 0.29.0 | 12 / 36 | |
| 0.28.13 | 12 / 36 | |
| 0.28.11 | 12 / 36 | |
| 0.28.10 | 12 / 36 | |
| 0.28.9 | 12 / 36 | |
| 0.28.7 | 12 / 36 | |
| 0.28.6 | 12 / 36 | |
| 0.28.5 | 12 / 36 | |
| 0.28.4 | 12 / 36 | |
| 0.28.3 | 12 / 37 | |
| 0.28.2 | 12 / 37 | |
| 0.28.1 | 12 / 37 | |
| 0.28.0 | 12 / 37 | |
| 0.27.1 | 12 / 38 | |
| 0.27.0 | 12 / 38 | |
| 0.26.8 | 12 / 36 | |
| 0.26.5 | 12 / 38 | |
| 0.25.6 | 10 / 0 | |
| 0.25.5 | 10 / 0 | |
| 0.25.4 | 10 / 0 |
v0.39.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.38.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.38.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.36.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.36.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.1
2 findingsThis version was published by a different npm account than previous versions on 2025-03-13. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.13
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.11
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.10
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.9
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.7
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.6
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.5
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.4
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.3
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.2
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.1
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.0
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.1
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.0
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.8
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.5
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: webmaster128.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.