kxco-verify 1.0.2 → 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/package.json +9 -2
package/README.md
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
# kxco-verify
|
|
2
2
|
|
|
3
3
|
[](https://www.npmjs.com/package/kxco-verify)
|
|
4
|
+
[](https://socket.dev/npm/package/kxco-verify)
|
|
4
5
|
[](./LICENSE)
|
|
6
|
+
[](https://nodejs.org)
|
|
5
7
|
[](https://verify.kxco.ai)
|
|
6
8
|
|
|
7
9
|
**Independent, browser-safe verifier for post-quantum signed deploy attestations** produced by sites using [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum).
|
|
@@ -147,6 +149,18 @@ The test suite verifies the math against both.
|
|
|
147
149
|
|
|
148
150
|
---
|
|
149
151
|
|
|
152
|
+
## Security
|
|
153
|
+
|
|
154
|
+
Signature verification uses [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) ML-DSA-65 — independently audited by Cure53 (2024), no transitive dependencies. The library makes no outbound requests beyond the attestation URL you supply and the `pinAt` endpoint declared in the manifest itself. No data is sent to KXCO.
|
|
155
|
+
|
|
156
|
+
To report a vulnerability, open a [private security advisory](https://github.com/JackKXCO/kxco-verify/security/advisories/new) or email **security@kxco.ai**.
|
|
157
|
+
|
|
158
|
+
## Funding
|
|
159
|
+
|
|
160
|
+
Maintained by **Shayne Heffernan** and **John Heffernan** at [KXCO by Knightsbridge](https://kxco.ai).
|
|
161
|
+
|
|
162
|
+
[Knightsbridge Law](https://knightsbridge.law) · [target150.com](https://target150.com) · [livetradingnews.com](https://livetradingnews.com)
|
|
163
|
+
|
|
150
164
|
## License
|
|
151
165
|
|
|
152
166
|
Apache 2.0 — see [LICENSE](./LICENSE).
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-verify",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.4",
|
|
4
4
|
"description": "Independent, browser-safe verifier for KXCO post-quantum signed deploy attestations. Verifies ML-DSA-65 (NIST FIPS 204) signatures emitted by sites that use kxco-post-quantum. No trust delegation: this library tells you whether the signature math checks out and whether the manifest-declared key matches the live well-known endpoint \u00e2\u20ac\u201d it does NOT vouch for any site.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
@@ -12,7 +12,14 @@
|
|
|
12
12
|
"verification",
|
|
13
13
|
"attestation",
|
|
14
14
|
"verify",
|
|
15
|
-
"kxco-post-quantum"
|
|
15
|
+
"kxco-post-quantum",
|
|
16
|
+
"browser",
|
|
17
|
+
"browser-safe",
|
|
18
|
+
"zero-dependencies",
|
|
19
|
+
"supply-chain",
|
|
20
|
+
"deploy-attestation",
|
|
21
|
+
"provenance",
|
|
22
|
+
"manifest-verification"
|
|
16
23
|
],
|
|
17
24
|
"license": "Apache-2.0",
|
|
18
25
|
"author": "KXCO by Knightsbridge <hello@kxco.ai>",
|