@noble/curves MIT 48 versions

@noble/curves

npm Repository Homepage

Audited & minimal JS implementation of elliptic curve cryptography

48

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

paulmillr

Keywords

cryptographysecp256k1ed25519p256p384p521secp256r1ed448x25519ed25519bls12-381bn254alt_bn128blsnobleeccecdsaeddsaoprfschnorrfft

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Noble-curves legitimately adds many new curve implementations (BLS12-381, ed448, p192, p224, p384, p521, pasta, stark, jubjub, etc.) as the library expands; large file counts are expected for this package.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): @noble/hashes is Paul Miller's own companion library in the noble suite; adding it as a runtime dep is expected and not a supply-chain risk for this package.	ai	2026/04/22
source-diff	source-size-tripled	AI (source-diff): Size growth reflects legitimate expansion of curve implementations (especially BLS12-381 ~54KB each for CJS/ESM). Expected for a growing cryptography library.	ai	2026/04/22
source-diff	net-exec-file:src/abstract/oprf.ts	AI (source-diff): Legitimate RFC 9497 OPRF cryptographic implementation; URLs are documentation references, not network calls or dynamic execution.	ai	2026/04/22
source-diff	net-exec-file:abstract/oprf.d.ts	AI (source-diff): OPRF type definition file; URL references are RFC documentation links, not network calls. No actual dynamic code execution present.	ai	2026/04/22
source-diff	net-exec-file:abstract/frost.js	AI (source-diff): FROST is a legitimate RFC 9591 threshold signature protocol implementation. 'Network' references are protocol semantics, not actual network I/O. No HTTP/fetch calls present in the sample.	ai	2026/04/21
provenance	publisher-changed	AI (provenance): paulmillr migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation. This is a supply chain improvement, not a compromise. Stable for this package going forward.	ai	2026/04/21
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy explained by major feature development (FROST threshold signatures) and CI/CD migration. SLSA provenance confirms legitimate publish pipeline.	ai	2026/04/21
source-diff	net-exec-file:src/abstract/frost.ts	AI (source-diff): TypeScript source for FROST RFC 9591 implementation. Same false positive as the compiled JS — no actual network calls or dynamic code execution present.	ai	2026/04/21

Versions (showing 48 of 48)

Version	Deps	Published
2.2.0	1 / 5	2026-04-12
2.0.1	1 / 5	2025-09-22
2.0.0	1 / 5	2025-08-25
1.9.7	1 / 7	2025-08-15
1.9.6	1 / 7	2025-07-30
1.9.5	1 / 7	2025-07-29
1.9.4	1 / 7	2025-07-17
1.9.3	1 / 7	2025-07-16
1.9.2	1 / 7	2025-06-05
1.9.1	1 / 6	2025-05-14
1.9.0	1 / 6	2025-04-23
1.8.2	1 / 6	2025-04-14
1.8.1	1 / 6	2025-01-18
1.7.0	1 / 6	2024-11-22
1.6.0	1 / 6	2024-09-03
1.5.0	1 / 6	2024-08-07
1.4.2	1 / 6	2024-07-01
1.4.1	1 / 6	2024-07-01
1.4.0	1 / 5	2024-03-14
1.3.0	1 / 5	2023-12-11
1.2.0	1 / 5	2023-08-23
1.1.0	1 / 5	2023-06-03
1.0.0	1 / 5	2023-04-12
0.9.1	1 / 8	2023-03-31
0.9.0	1 / 8	2023-03-24
0.8.3	1 / 8	2023-03-16
0.8.2	1 / 8	2023-03-13
0.8.1	1 / 8	2023-03-13
0.8.0	1 / 8	2023-03-03
0.7.3	1 / 8	2023-02-26
0.7.2	1 / 8	2023-02-25
0.7.1	1 / 8	2023-02-15
0.7.0	1 / 8	2023-02-14
0.6.4	1 / 9	2023-02-09
0.6.3	1 / 9	2023-02-09
0.6.2	1 / 11	2023-01-30
0.6.1	1 / 11	2023-01-29
0.6.0	1 / 11	2023-01-26
0.5.2	1 / 11	2023-01-13
0.5.1	1 / 11	2022-12-31
0.5.0	1 / 11	2022-12-28
0.4.0	0 / 6	2022-12-24
0.3.2	1 / 10	2022-12-21
0.3.1	1 / 10	2022-12-21
0.3.0	1 / 10	2022-12-21
0.2.1	0 / 6	2022-12-20
0.2.0	0 / 6	2022-12-15
0.1.0	0 / 6	2022-12-04

v0.9.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.