secretjs — Greenflagged

The JavaScript SDK for Secret Network

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

enigma-dev

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase is from bundled ProtoDefs.js protobuf definitions, explicitly added in build script; expected for this SDK.	ai	2026/04/27
source-diff	source-size-dropped	AI (source-diff): Size drop reflects refactoring of generated protobuf code; consistent with the 133 new TS source files added.	ai	2026/04/27
source-diff	obfuscated-file:build/ProtoEncoding.js	AI (source-diff): The long line is a serialized protobuf JSON descriptor string, not obfuscation. This pattern is expected when bundling protobuf schemas with protobufjs and is benign for this package.	ai	2026/04/24
phantom-deps	phantom-dep:js-crypto-hkdf	AI (phantom-deps): Declared crypto dependency used indirectly; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:fast-deep-equal	AI (phantom-deps): Declared utility dependency used indirectly; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:node-localstorage	AI (phantom-deps): Declared dependency used indirectly; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:@types/node-localstorage	AI (phantom-deps): Framework-scoped types package loaded by convention; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:pako	AI (phantom-deps): pako is a declared dependency used indirectly in crypto operations; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:axios	AI (phantom-deps): axios is a declared dependency used indirectly for HTTP operations; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:miscreant	AI (phantom-deps): miscreant is a declared crypto dependency used indirectly; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:@iov/utils	AI (phantom-deps): Declared @iov dependency used indirectly in SDK; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:@iov/encoding	AI (phantom-deps): Declared @iov dependency used indirectly in SDK; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:curve25519-js	AI (phantom-deps): Declared crypto dependency used indirectly; phantom-dep is a false positive for this library.	ai	2026/04/24
phantom-deps	phantom-dep:secure-random	AI (phantom-deps): Declared crypto dependency used indirectly; phantom-dep is a false positive for this library.	ai	2026/04/24
dependencies	unvetted-dep:protobufjs	AI (dependencies): protobufjs is a well-known, widely-used protobuf library; expected dependency for a blockchain SDK communicating via protobuf. Stable for this package.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): cross-fetch and google-protobuf are well-known legitimate packages; their addition reflects a documented transport layer refactor in this Cosmos SDK client.	ai	2026/04/24
source-diff	large-new-source-files	AI (source-diff): secretjs ships generated protobuf stubs as part of its SDK; large file additions are expected when protobuf definitions are updated. Not indicative of injected malicious code.	ai	2026/04/24
source-diff	obfuscated-file:dist/browser.js	AI (source-diff): dist/browser.js is a standard webpack-minified browser bundle for the secretjs SDK. The license header and module pattern confirm legitimate webpack output, not malicious obfuscation.	ai	2026/04/24
source-diff	net-exec-file:dist/browser.js	AI (source-diff): Network calls and dynamic module loading in dist/browser.js are expected for a blockchain client SDK (RPC calls + webpack module system). Not a dropper/loader pattern.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Lack of Sigstore provenance is a governance concern but not a code-level security risk for this mature package.	ai	2026/04/24
phantom-deps	phantom-dep:@osmonauts/helpers	AI (phantom-deps): Referenced in build config; phantom-dep pattern is stable for this package across versions.	ai	2026/04/24
phantom-deps	phantom-dep:sinon	AI (phantom-deps): Sinon is a test/build dependency referenced in config; phantom-dep pattern is stable for this package.	ai	2026/04/24
phantom-deps	phantom-dep:@cosmjs/math	AI (phantom-deps): Legitimate declared dependency for a crypto SDK; used in build/config context. Not a security concern for this package.	ai	2026/04/24
phantom-deps	phantom-dep:patch-package	AI (phantom-deps): patch-package is intentionally declared as a runtime dep to support the postinstall script; stable pattern for this package.	ai	2026/04/24
phantom-deps	phantom-dep:google-protobuf	AI (phantom-deps): google-protobuf is a legitimate protobuf runtime dependency for this Secret Network SDK; referenced in build config.	ai	2026/04/24
install-scripts	install-script:postinstall	AI (install-scripts): postinstall runs `patch-package`, a standard tool for patching node_modules. This is a documented, legitimate pattern for this SDK and stable across versions.	ai	2026/04/23
dependencies	unvetted-dep:google-protobuf	AI (dependencies): google-protobuf is a Google-published, widely-used protobuf library. Stable false positive for this package.	ai	2026/04/23
source-diff	encoded-string-file:dist/browser.js	AI (source-diff): Long encoded strings in dist/browser.js are standard webpack UMD bundle output, not obfuscated malicious payloads. The license header and bundle structure confirm legitimate build output.	ai	2026/04/23