cosmjs-types
JS and TS types relating to Protocol Buffers used by Cosmos SDK and other related projects
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): cosmjs-types grows with each release as more protobuf definitions are codegen'd into JS/TS. Size increases are expected and benign for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): webmaster128 is the legitimate publisher with 1035 approved packages and 2813 days of history; this maintainer addition is a legitimate transfer, not a takeover. | ai | |
| dependencies | unvetted-dep:protobufjs | AI (dependencies): protobufjs is a core, well-known dependency expected for a Protobuf types package; its use here is entirely legitimate and stable across versions. | ai | |
| source-diff | large-new-source-files | AI (source-diff): cosmjs-types is a codegen package; new source files are protobuf-generated types matching the package's documented purpose. Large file additions are expected with each Cosmos SDK update. | ai | |
| provenance | no-provenance | AI (provenance): Established package with strong publisher track record; lack of Sigstore provenance is not a material risk signal here. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 0.11.0 | 0 / 4 | |
| 0.10.1 | 0 / 4 | |
| 0.10.0 | 0 / 4 | |
| 0.9.0 | 0 / 4 | |
| 0.8.0 | 2 / 5 | |
| 0.7.2 | 2 / 5 | |
| 0.7.1 | 2 / 5 | |
| 0.7.0 | 2 / 5 | |
| 0.6.1 | 2 / 5 | |
| 0.6.0 | 2 / 5 | |
| 0.5.2 | 2 / 5 | |
| 0.5.1 | 2 / 5 | |
| 0.5.0 | 2 / 5 | |
| 0.4.1 | 2 / 5 | |
| 0.4.0 | 2 / 5 | |
| 0.3.0 | 2 / 5 | |
| 0.2.1 | 2 / 5 | |
| 0.2.0 | 2 / 5 | |
| 0.1.0 | 2 / 5 |
v0.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.