Gathering detailed insights and metrics for @bitgo-beta/unspents
Gathering detailed insights and metrics for @bitgo-beta/unspents
Installations
npm install @bitgo-beta/unspentsDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Node Version
14.18.0
NPM Version
lerna/5.5.0/node@v14.18.0+x64 (darwin)
Releases
2
Languages
8
TypeScript
JavaScript
WebAssembly
Dockerfile
Shell
HTML
SCSS
Nix
TypeScript (94.53%)
JavaScript (5.11%)
WebAssembly (0.28%)
Dockerfile (0.05%)
Shell (0.03%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
Apache-2.0 License
373 Stars
16,931 Commits
296 Forks
77 Watchers
3,792 Branches
574 Contributors
Updated on Jul 17, 2025
Maintainers
1
Package Meta Information
Latest Version
0.8.3
Package Id
@bitgo-beta/unspents@0.8.3
Unpacked Size
65.73 kB
Size
16.48 kB
File Count
22
NPM Version
lerna/5.5.0/node@v14.18.0+x64 (darwin)
Node Version
14.18.0
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
4
Dev Dependencies
4
@bitgo/unspents
The package provides a Dimensions class with methods to calculate bitcoin transaction sizes
Installation
npm install --save @bitgo/unspents
Dimensions, Virtual Size Estimation
The transaction vSize is critical to calculating the proper transaction fee.
The class unspents.Dimensions provides a class that helps work with the components required
to calculate an accurate estimate of a transaction vSize.
Examples
1import { Codes, Dimensions } from '@bitgo/unspents'; 2// using raw attributes 3new Dimensions({ 4 nP2shInputs: 1, 5 nP2shP2wshInputs: 1, 6 nP2wshInputs: 1, 7 outputs: { count: 1, size: 32 }, 8}); 9 10// calculate from unspents that have `chain` property (see Chain Codes) 11Dimensions.fromUnspents(unspent[0]); 12Dimensions.fromUnspents(unspents); 13 14// Signed inputs work too 15Dimensions.fromInput(inputs[0]); 16Dimensions.fromInputs(inputs); 17 18// Transaction outputs 19Dimensions.fromOutputs(outputs[0]); 20Dimensions.fromOutputs(outputs); 21Dimensions.fromOutputOnChain(Codes.p2sh.internal); 22Dimensions.fromOutputScriptLength(31); 23 24// Combining dimensions and estimating their vSize 25Dimensions.fromUnspents({ unspents }) 26 .plus(Dimensions.fromOutputOnChain(Codes.p2shP2wsh.internal).times(nOutputs)) 27 .getVSize();
Publishing new versions
Publishing new versions should be done by running the publish script in scripts/publish.sh.
It can be invoked with the name of the branch to release, and will default to the currently checked out branch if not given.
It will perform validation of all prepublish conditions, run a dry-run publish, then, if successful, a real publish. After that is complete,
the newly installed package will be downloaded and require()'d to ensure the package was published correctly.
Continuous Integration
@bitgo/unspents uses Drone for continuous integration, which is configured by the .drone.yml file in the project root. However, this file should not be modified by hand. All changes to the CI process should be done by modifying the .drone.jsonnet file, then running npm run generate_drone to rebuild the .drone.yml file.
Codes
The exported Codes module is now deprecated.
Please use utxo-lib/src/bitgo/wallet/chains instead.
No vulnerabilities found.
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
binaries present in source code
Details
- Warn: binary detected: modules/account-lib/resources/cspr/contract/keys-manager.wasm:1
- Warn: binary detected: modules/blake2b-wasm/blake2b.wasm:1
Reason
dependency not pinned by hash detected -- score normalized to 7
Details
- Warn: npmCommand not pinned by hash: modules/bitgo/scripts/publish.sh:49
- Warn: npmCommand not pinned by hash: modules/bitgo/scripts/publish.sh:75
- Warn: npmCommand not pinned by hash: modules/express/scripts/update-bitgo.sh:5
- Warn: npmCommand not pinned by hash: modules/statics/scripts/publish.sh:49
- Warn: npmCommand not pinned by hash: modules/statics/scripts/publish.sh:76
- Warn: npmCommand not pinned by hash: modules/unspents/scripts/publish.sh:49
- Warn: npmCommand not pinned by hash: modules/unspents/scripts/publish.sh:76
- Info: 17 out of 17 GitHub-owned GitHubAction dependencies pinned
- Info: 4 out of 4 containerImage dependencies pinned
- Info: 1 out of 8 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:14
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/ci.yml:15
- Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql.yaml:12
- Info: topLevel 'actions' permission set to 'read': .github/workflows/codeql.yaml:13
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yaml:14
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/publish.yml:9
- Info: no jobLevel write permissions found
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
31 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-75v8-2h7p-7m2m
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-7v5v-9h63-cj86
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-3gc7-fjrx-p6mg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-7x7c-qm48-pq9c
- Warn: Project is vulnerable to: GHSA-rc3x-jf5g-xvc5
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-6fx8-h7jm-663j
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-w5hq-hm5m-4548
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-27v7-qhfv-rqq8
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
5.8
/10
Last Scanned on 2025-07-14
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More