Vendored dependencies

blamejs ships with zero npm runtime dependencies. Every third-party package the framework relies on is bundled under lib/vendor/ and committed to the repository, with its version, license, source URL and SHA-256 recorded in lib/vendor/MANIFEST.json. Refreshes go through scripts/vendor-update.sh; the SHA-256 changes whenever the bundle changes, so supply-chain drift is observable in git diff.

This page is generated at build time from lib/vendor/MANIFEST.json — the canonical source of truth — enriched with the framework files that require() each vendor bundle. The categories below mirror the security domains operators reason about when they audit the supply chain.

Crypto

PackageUsed forLicenseSource
@noble/ciphers 2.4.0XChaCha20-Poly1305 AEAD cipherMITgithub.com/paulmillr/noble-ciphers
@noble/post-quantum 0.7.1ML-KEM / ML-DSA / SLH-DSA via FIPS 203 / 204 / 205MITgithub.com/paulmillr/noble-post-quantum
Required by 5 framework files
  • lib/_test/crypto-fixtures.js
  • lib/backup/crypto.js
  • lib/crypto-hpke.js
  • lib/crypto.js
  • lib/vault/wrap.js
Required by 2 framework files
  • lib/crypto-xwing.js
  • lib/pqc-software.js

PKI

PackageUsed forLicenseSource
@blamejs/pki 0.9.4Zero-dep X.509 / CRL / PKCS#12 / CMS toolkit for b.mtlsCa (ML-DSA-87 + ECDSA-P384), plus WebAuthn verification for b.auth.passkeyApache-2.0github.com/blamejs/pki
Required by 2 framework files
  • lib/auth/passkey.js
  • lib/mtls-engine-default.js

Other

PackageUsed forLicenseSource
@noble/curves 2.4.0MITgithub.com/paulmillr/noble-curves
@noble/hashes 2.4.0Browser build only.MITgithub.com/paulmillr/noble-hashes
SecLists-common-passwords-top-10000 10k-most-common (master)NIST 800-63B §5.1.1.2 breached-password listCC-BY-3.0github.com/danielmiessler/SecLists
bimi-trust-anchors operator-managedBIMI (draft-blank-ietf-bimi) Group Verified Mark trust-anchor bundle (PEM, concatenated).BIMI Group / per-issuerbimigroup.org/
publicsuffix-list masterMozilla Public Suffix List — canonical catalog of effective top-level domains used by b.publicSuffix to derive organizational domains for DMARCbis (psd= / np=), BIMI, cookie-scope checks, and same-site policies.MPL-2.0publicsuffix.org/list/public_suffix_list.dat
Required by 1 framework file
  • lib/crypto-oprf.js
Required by 1 framework file
  • lib/vendor-data.js
Required by 1 framework file
  • lib/vendor-data.js
Required by 2 framework files
  • lib/public-suffix.js
  • lib/vendor-data.js

Last updated 2026-10-12T14:21:56.879Z by seeder.