ox
Ethereum Standard Library
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:_esm/tempo/index.js | AI (source-diff): Hex-encoded Ethereum tx data in JSDoc examples, not executable payload; stable for this package. | ai | |
| source-diff | encoded-string-file:_types/tempo/index.d.ts | AI (source-diff): Same JSDoc example hex strings in type declarations; stable false positive. | ai | |
| source-diff | encoded-string-file:tempo/index.ts | AI (source-diff): Same JSDoc example hex strings in source; stable false positive. | ai | |
| semgrep | semgrep:shady-links-tlds | AI (semgrep): tempo.xyz is the project's own domain; .xyz TLD is legitimate here. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai | |
| typosquat | typosquat.levenshtein:koa | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Standard worker_threads lazy-load pattern in a WASM worker pool; not arbitrary code execution. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai | |
| typosquat | typosquat.levenshtein:mobx | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai | |
| typosquat | typosquat.levenshtein:got | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): 'ox' is a legitimate established package; short-name Levenshtein matches are noise. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 0.14.27 | 8 / 0 | |
| 0.14.26 | 8 / 0 | |
| 0.14.25 | 8 / 0 | |
| 0.14.24 | 8 / 0 | |
| 0.14.23 | 8 / 0 | |
| 0.14.22 | 8 / 0 | |
| 0.14.21 | 8 / 0 | |
| 0.14.20 | 8 / 0 | |
| 0.14.16 | 8 / 0 | |
| 0.14.11 | 8 / 0 | |
| 0.14.8 | 8 / 0 | |
| 0.14.5 | 8 / 0 | |
| 0.14.1 | 8 / 0 | |
| 0.12.4 | 8 / 0 | |
| 0.12.0 | 8 / 0 | |
| 0.9.10 | 8 / 0 | |
| 0.9.9 | 8 / 0 | |
| 0.9.4 | 8 / 0 | |
| 0.8.7 | 8 / 0 | |
| 0.8.6 | 8 / 0 | |
| 0.8.5 | 8 / 0 | |
| 0.8.4 | 8 / 0 | |
| 0.8.3 | 8 / 0 | |
| 0.8.2 | 8 / 0 | |
| 0.7.1 | 8 / 0 |
v0.14.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.26
2 findingsModified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.25
4 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.24
4 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.23
4 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.