@scure/bip32

Secure, audited & minimal implementation of BIP32 hierarchical deterministic (HD) wallets over secp256k1

Supply chain provenance

Status for the latest visible version.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@noble/secp256k1	AI (dependencies): @noble/secp256k1 is Paul Miller's own audited secp256k1 library — a natural, expected dependency for a BIP32 implementation by the same author. Not a risk for this package.	ai	2026/04/22
provenance	no-provenance	AI (provenance): Established package from a long-standing, trusted publisher (paulmillr). Lack of Sigstore provenance is common and not a risk signal here.	ai	2026/04/22
dependencies	unvetted-dep:@noble/curves	AI (dependencies): @noble/curves is a well-known, audited elliptic curve library by Paul Miller, part of the same noble/scure ecosystem. Unvetted status is a registry artifact, not a real risk signal for this package.	ai	2026/04/21

Version	Deps	Published
2.0.1	3 / 3	2025-10-07
2.0.0	3 / 3	2025-08-25
1.7.0	3 / 4	2025-04-24
1.6.2	3 / 4	2025-01-18
1.6.0	3 / 4	2024-11-23
1.5.0	3 / 4	2024-09-03
1.4.0	3 / 4	2024-03-20
1.3.3	3 / 3	2023-12-12
1.3.2	3 / 3	2023-08-25
1.3.1	3 / 3	2023-07-10
1.3.0	3 / 3	2023-04-12
1.2.0	3 / 3	2023-03-16
1.1.5	3 / 3	2023-02-02
1.1.4	3 / 3	2023-02-02
1.1.3	3 / 4	2023-01-09
1.1.2	3 / 4	2023-01-09
1.1.1	3 / 4	2022-09-30
1.1.0	3 / 4	2022-06-11
1.0.1	3 / 4	2022-01-26