ganache
A library and cli to create a local blockchain for fast Ethereum development.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Native .node addons from leveldown/keccak/secp256k1 are expected and well-documented for this Ethereum tooling package. | ai | |
| phantom-deps | phantom-dep:@types/bn.js | AI (phantom-deps): @types packages bundled for type resolution; not directly imported at runtime by design. | ai | |
| phantom-deps | phantom-dep:@types/lru-cache | AI (phantom-deps): @types packages bundled for type resolution; not directly imported at runtime by design. | ai | |
| phantom-deps | phantom-dep:@types/seedrandom | AI (phantom-deps): @types packages bundled for type resolution; not directly imported at runtime by design. | ai |
v7.9.2
2 findingsPackage contains compiled binaries that could be backdoors: • node_modules/leveldown/prebuilds/linux-arm/node.napi.armv6.node • node_modules/leveldown/prebuilds/android-arm/node.napi.armv7.node • node_modules/leveldown/prebuilds/linux-arm/node.napi.armv7.node • node_modules/leveldown/prebuilds/android-arm64/node.napi.armv8.node • node_modules/leveldown/prebuilds/linux-arm64/node.napi.armv8.node • node_modules/keccak/prebuilds/linux-x64/node.napi.glibc.node • node_modules/leveldown/prebuilds/linux-x64/node.napi.glibc.node • node_modules/secp256k1/prebuilds/linux-x64/node.napi.glibc.node • node_modules/keccak/prebuilds/linux-x64/node.napi.musl.node • node_modules/leveldown/prebuilds/linux-x64/node.napi.musl.node ... and 10 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v7.4.3
2 findingsPackage contains compiled binaries that could be backdoors: • dist/node/1EqnROUa.node • dist/node/1Lefr_9I.node • dist/node/1RGFZdPM.node • dist/node/222l8vHq.node • dist/node/2CgMg5b8.node • dist/node/2r0K-G8m.node • dist/node/2wXeEMb1.node • dist/node/3A2fPZNX.node • dist/node/3QqmSccB.node • dist/node/3V6RmN_1.node ... and 25 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.