1# WASM Blob Provenance23> Target location: repository root (`WASM-PROVENANCE.md`). Added by audit4> fix LV-9.56The following packages ship prebuilt `.wasm` blobs that have **not** been7byte-verified against a reproducible build:89- `@bokuweb/[email protected]` — zstd compression (Codex / PeachScript payloads)10- `@subspace/[email protected]` — Codex erasure coding11- `[email protected]` — Argon2id KDF (**crypto-critical**)12- vendored `public/ggwave/ggwave.js` + `ggwave.wasm` — ultrasonic pairing13 (carries local patch PEACH-PATCH LV-7; see `src/drafts/AUDIT-FIXES/patches/LV-7-ggwave-newfunction-proto.md`)1415These are pinned to exact versions in `package.json` (audit fix LV-9). Any16version bump requires, before merge:17181. Manual review of the upstream diff/release notes.192. SHA-256 of the shipped `.wasm` blob recorded below, verified against the20 upstream release artifact (or a local reproducible build where upstream21 provides one).223. Re-application of any local patches (currently: ggwave LV-7).2324## Recorded digests2526Recorded 2026-06-09 (`shasum -a 256`) at the pinned versions. hash-wasm and27ggwave inline their WASM as base64 inside JS, so the JS bundle is hashed;28zstd and reed-solomon ship standalone `.wasm` blobs.2930```31dcec617a2e1b700fa132d1583a186cb70611113395e869f2dd6cc82b415d3094 node_modules/hash-wasm/dist/argon2.umd.min.js (argon2id wasm, inlined)3280260eee5795ee8072bb5821e203730c74dca3909938f5ac1128da67f96223df node_modules/@bokuweb/zstd-wasm/dist/esm/zstd.wasm33cd64629066151189f59e77efec8e45511605d7fff61836a00c1c9220d92873ec node_modules/@subspace/reed-solomon-erasure.wasm/dist/reed_solomon_erasure_bg.wasm3488ed23a8ae43bb12593ca3e767c4350b695cba610254a9d30940d4a225c837bf public/ggwave/ggwave.js (ggwave wasm inlined; includes PEACH-PATCH LV-7)35```3637Audit reference: peach-browser-security-audit.md, Open Question 3.