@polkadot/util-crypto
A collection of useful crypto utilities for @polkadot
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/en.js | AI (source-diff): BIP-39 English wordlist stored as a pipe-delimited string — standard format for mnemonic word lists, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/es.js | AI (source-diff): BIP-39 Spanish wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/en.js | AI (source-diff): BIP-39 English wordlist stored as a pipe-delimited string — standard format for mnemonic word lists, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/zh-t.js | AI (source-diff): BIP-39 Traditional Chinese wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/zh-t.js | AI (source-diff): BIP-39 Traditional Chinese wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/zh-s.js | AI (source-diff): BIP-39 Simplified Chinese wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/zh-s.js | AI (source-diff): BIP-39 Simplified Chinese wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/ko.js | AI (source-diff): BIP-39 Korean wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/ko.js | AI (source-diff): BIP-39 Korean wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/jp.js | AI (source-diff): BIP-39 Japanese wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/jp.js | AI (source-diff): BIP-39 Japanese wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/it.js | AI (source-diff): BIP-39 Italian wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/it.js | AI (source-diff): BIP-39 Italian wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/fr.js | AI (source-diff): BIP-39 French wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/wordlists/fr.js | AI (source-diff): BIP-39 French wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | obfuscated-file:mnemonic/wordlists/es.js | AI (source-diff): BIP-39 Spanish wordlist stored as a pipe-delimited string — standard format, not obfuscated code. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Significant source reduction in mature crypto utility library likely reflects legitimate refactoring/cleanup, not code replacement. Consistent with established publisher's track record. | ai | |
| source-diff | obfuscated-file:cjs/mnemonic/bip39-en.js | AI (source-diff): The 'obfuscated' file is the BIP39 English wordlist stored as a pipe-delimited string — a standard data file, not obfuscated code. Long line is 2048 mnemonic words concatenated. | ai | |
| dependencies | unvetted-dep:@types/pbkdf2 | AI (dependencies): @types/pbkdf2 is a standard TypeScript type definition package for the pbkdf2 library. Low risk for this well-established crypto utility package. | ai | |
| dependencies | unvetted-dep:@polkadot/schnorrkel-js | AI (dependencies): @polkadot/schnorrkel-js is the official Schnorr/sr25519 WASM binding from the same Polkadot JS organization; entirely expected in this crypto utility package. | ai | |
| dependencies | unvetted-dep:@types/secp256k1 | AI (dependencies): @types/secp256k1 is a DefinitelyTyped TypeScript type definition package for the secp256k1 library — a legitimate and expected dependency for a crypto utility package. | ai | |
| phantom-deps | phantom-dep:@noble/hashes | AI (phantom-deps): @noble/hashes is vendored/bundled under ./noble-hashes/lib/ in the package exports map; not imported via node_modules path. Phantom-dep detection is a false positive for this bundling pattern. | ai | |
| source-diff | obfuscated-file:noble-hashes/lib/sha512.cjs | AI (source-diff): File is Babel-transpiled CJS output of the @noble/hashes library (MIT, paulmillr.com). Long lines are due to transpiler helpers and inline SHA-512 constants, not obfuscation. Stable false positive for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 150 new files are the vendored @noble/hashes library replacing multiple older hash dependencies. Deliberate consolidation by a trusted publisher, not injected code. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): polkadotjs publisher has 4079 approved/0 rejected packages; dormancy followed by legitimate coordinated ecosystem release is expected for this well-established package. | ai | |
| dependencies | unvetted-dep:elliptic | AI (dependencies): elliptic is a well-known JS elliptic curve library; its use in a crypto utility package for secp256k1 operations is expected and legitimate. | ai | |
| phantom-deps | phantom-dep:create-hash | AI (phantom-deps): create-hash is a standard hashing dependency; phantom detection is a false positive for this crypto utility package. | ai | |
| phantom-deps | phantom-dep:bn.js | AI (phantom-deps): bn.js is a standard big-number dependency used transitively in crypto operations; phantom detection is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/secp256k1 | AI (phantom-deps): @types/* packages are TypeScript type definitions loaded by convention, not directly imported. This is standard practice for this package. | ai | |
| phantom-deps | phantom-dep:@types/pbkdf2 | AI (phantom-deps): @types/* packages are TypeScript type definitions loaded by convention, not directly imported. This is standard practice for this package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is used to load the compiled schnorrkel WebAssembly binary — canonical WASM-in-npm pattern, not a hidden payload. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require() in wasm-bindgen generated glue code for schnorrkel WASM module — standard wasm-bindgen output, not malicious. | ai | |
| source-diff | obfuscated-file:schnorrkel/schnorrkel-js/schnorrkel_js_bg.js | AI (source-diff): This file is a wasm-bindgen generated JS wrapper containing a hex-encoded WebAssembly binary (schnorrkel/sr25519). The pattern is canonical for WASM-in-npm packages and is not obfuscation. | ai | |
| source-diff | obfuscated-file:schnorrkel/schnorrkel-js/schnorrkel_js_wasm.js | AI (source-diff): File is a base64-encoded WebAssembly binary (AGFzbQ = \0asm magic bytes) generated by wasm-bindgen. Standard pattern for WASM-based crypto libraries in the Polkadot ecosystem. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is standard wasm-bindgen glue code for bridging WASM imports to JS. Input comes from WASM memory, not user-controlled external sources. | ai | |
| source-diff | encoded-string-file:blake2/asHex.spec.js | AI (source-diff): Long strings in spec files are cryptographic test vectors (expected hash outputs), not encoded payloads. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is entirely explained by the embedded WASM binary for Schnorrkel signatures, a legitimate cryptographic addition. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): bip39 and @types/bip39 are legitimate, well-known packages expected in a blockchain crypto utility library; addition is consistent with the package's purpose. | ai | |
| phantom-deps | phantom-dep:@types/webassembly-js-api | AI (phantom-deps): @types/* packages are TypeScript type declarations; not being directly imported is expected and normal for this package type. | ai | |
| phantom-deps | phantom-dep:@types/xxhashjs | AI (phantom-deps): @types/* packages are TypeScript type declarations; not being directly imported is expected and normal for this package type. | ai | |
| dependencies | unvetted-dep:@types/bip39 | AI (dependencies): @types/bip39 is a TypeScript type definitions package — purely a development/type aid with no runtime risk. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/bip39 | AI (phantom-deps): @types/bip39 is a TypeScript type definitions package; it is normal for TS libraries to declare @types/* as dependencies for consumers even without direct imports. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance; trusted publisher with 8385 approved packages. Stable false positive for this package. | ai | |
| source-diff | encoded-string-file:blake2/blake2b/asHex.spec.js | AI (source-diff): Long hex strings in this file are cryptographic test vectors for blake2b correctness verification — standard practice in crypto library test suites, not malicious payloads. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): paritytech-ci is a known trusted publisher in the Polkadot ecosystem; the maintainer addition reflects a legitimate org-level CI transition. | ai | |
| provenance | publisher-changed | AI (provenance): paritytech-ci is the established Parity Technologies CI publisher for the polkadot-js ecosystem with 67 approved packages and 0 rejections; this transition is legitimate. | ai | |
| source-diff | encoded-string-file:bundle-polkadot-util-crypto.js | AI (source-diff): Long base64 string is a zlib-compressed WASM binary embedded in the bundle — standard practice for polkadot-js packages, not a malicious payload. | ai | |
| phantom-deps | phantom-dep:@polkadot/wasm-util | AI (phantom-deps): Same-org scope dependency declared but not directly imported; expected pattern for the @polkadot monorepo structure. | ai | |
| semgrep | semgrep:shady-links-tlds | AI (semgrep): URLs in this package are blockchain network metadata (website fields), not C2 infrastructure. This is a stable false positive for this package. | ai |
Versions (showing 100 of 375)
| Version | Deps | Published |
|---|---|---|
| 0.90.1 | 14 / 0 | |
| 0.76.1 | 14 / 0 | |
| 0.75.1 | 16 / 0 | |
| 0.43.1 | 16 / 0 | |
| 0.42.1 | 16 / 0 | |
| 0.41.1 | 16 / 0 | |
| 0.40.1 | 16 / 0 | |
| 0.39.1 | 15 / 0 | |
| 0.38.1 | 14 / 0 | |
| 0.36.1 | 14 / 0 | |
| 0.34.26 | 13 / 0 | |
| 0.34.24 | 13 / 0 | |
| 0.34.21 | 11 / 0 | |
| 0.34.19 | 10 / 0 | |
| 0.34.18 | 10 / 0 | |
| 0.34.16 | 11 / 0 | |
| 0.34.13 | 11 / 0 | |
| 0.34.12 | 10 / 0 | |
| 0.34.11 | 10 / 0 | |
| 0.34.10 | 10 / 0 | |
| 0.34.9 | 10 / 0 | |
| 0.34.8 | 10 / 0 | |
| 0.34.7 | 10 / 0 | |
| 0.34.6 | 10 / 0 | |
| 0.34.5 | 10 / 0 | |
| 0.34.4 | 9 / 0 | |
| 0.34.3 | 9 / 0 | |
| 0.34.2 | 9 / 0 | |
| 0.34.1 | 9 / 0 | |
| 0.33.36 | 8 / 0 | |
| 0.33.35 | 8 / 0 | |
| 0.33.34 | 8 / 0 | |
| 0.33.33 | 8 / 0 | |
| 0.33.30 | 8 / 0 | |
| 0.33.29 | 8 / 0 | |
| 0.33.28 | 8 / 0 | |
| 0.33.27 | 8 / 0 | |
| 0.33.26 | 8 / 0 | |
| 0.33.25 | 8 / 0 | |
| 0.33.24 | 8 / 0 | |
| 0.33.23 | 8 / 0 | |
| 0.33.22 | 8 / 0 | |
| 0.33.21 | 8 / 0 | |
| 0.33.20 | 8 / 0 | |
| 0.33.19 | 8 / 0 | |
| 0.33.18 | 8 / 0 | |
| 0.33.17 | 8 / 0 | |
| 0.33.16 | 8 / 0 | |
| 0.33.15 | 8 / 0 | |
| 0.33.14 | 8 / 0 | |
| 0.33.13 | 8 / 0 | |
| 0.33.12 | 8 / 0 | |
| 0.33.11 | 8 / 0 | |
| 0.33.10 | 8 / 0 | |
| 0.33.9 | 8 / 0 | |
| 0.33.8 | 8 / 0 | |
| 0.33.7 | 8 / 0 | |
| 0.33.6 | 8 / 0 | |
| 0.33.5 | 8 / 0 | |
| 0.33.4 | 8 / 0 | |
| 0.33.3 | 8 / 0 | |
| 0.33.2 | 8 / 0 | |
| 0.33.1 | 8 / 0 | |
| 0.32.23 | 8 / 0 | |
| 0.32.22 | 8 / 0 | |
| 0.32.20 | 8 / 0 | |
| 0.32.19 | 8 / 0 | |
| 0.32.18 | 8 / 0 | |
| 0.32.17 | 8 / 0 | |
| 0.32.15 | 8 / 0 | |
| 0.32.14 | 8 / 0 | |
| 0.32.13 | 8 / 0 | |
| 0.32.12 | 8 / 0 | |
| 0.32.11 | 8 / 0 | |
| 0.32.10 | 8 / 0 | |
| 0.32.9 | 8 / 0 | |
| 0.32.8 | 8 / 0 | |
| 0.32.7 | 8 / 0 | |
| 0.32.6 | 8 / 0 | |
| 0.32.5 | 8 / 0 | |
| 0.32.4 | 8 / 0 | |
| 0.32.3 | 8 / 0 | |
| 0.32.2 | 8 / 0 | |
| 0.32.1 | 8 / 0 | |
| 0.31.7 | 8 / 0 | |
| 0.31.6 | 8 / 0 | |
| 0.31.5 | 8 / 0 | |
| 0.31.4 | 8 / 0 | |
| 0.31.3 | 8 / 0 | |
| 0.31.2 | 8 / 0 | |
| 0.31.1 | 8 / 0 | |
| 0.30.7 | 6 / 0 | |
| 0.30.6 | 6 / 0 | |
| 0.30.5 | 6 / 0 | |
| 0.30.4 | 6 / 0 | |
| 0.30.3 | 6 / 0 | |
| 0.30.2 | 6 / 0 | |
| 0.30.1 | 6 / 0 | |
| 0.29.33 | 6 / 0 | |
| 0.29.32 | 6 / 0 |
v0.90.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.75.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.43.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.42.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.41.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.40.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.38.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.36.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.36
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.35
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.34
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.33
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.29
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.28
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.33
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.