@ledgerhq/device-signer-kit-hyperliquid
This package provides a signer implementation for hyperliquid.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:lib/cjs/internal/app-binder/utils/actionTlvSerializer.test.js | AI (source-diff): Hex strings are TLV serializer test vectors (expectedHex fields); stable false positive for this package. | ai | |
| source-diff | encoded-string-file:lib/esm/internal/app-binder/utils/actionTlvSerializer.test.js | AI (source-diff): ESM build of same test file; same TLV test vector pattern, stable false positive. | ai | |
| dependencies | unvetted-dep:purify-ts | AI (dependencies): purify-ts is a well-known functional programming library for TypeScript; its use here is legitimate and expected in a Ledger SDK package. | ai | |
| dependencies | unvetted-dep:@ledgerhq/signer-utils | AI (dependencies): First-party Ledger SDK package from the same LedgerHQ organization; legitimate dependency for this signer kit. | ai | |
| dependencies | unvetted-dep:@ledgerhq/context-module | AI (dependencies): First-party Ledger SDK package from the same LedgerHQ organization; legitimate dependency for this signer kit. | ai |
v1.1.0
3 findingsModified file contains 4 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 4 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v1.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v1.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v1.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.