@1st-flock/donations-embed
Embeddable browser donation flow web component for 1st Flock — registers <flock-donate>
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:class-variance-authority | AI (phantom-deps): Styling util used indirectly; stable FP. | ai | |
| phantom-deps | phantom-dep:clsx | AI (phantom-deps): Used via config/build tooling, common FP for utility CSS libs. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Peer framework dep referenced via JSX/build config. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Peer framework dep referenced via JSX/build config. | ai | |
| phantom-deps | phantom-dep:lucide-react | AI (phantom-deps): Icon lib likely tree-shaken/re-exported via components. | ai | |
| phantom-deps | phantom-dep:tailwind-merge | AI (phantom-deps): CSS utility referenced via build config. | ai | |
| dependencies | unvetted-dep:@1st-flock/payments | AI (dependencies): First-party sibling package, same org/scope. | ai | |
| dependencies | unvetted-dep:@1st-flock/donations | AI (dependencies): First-party sibling package, same org/scope. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1.3.2 | 18 / 16 | |
| 1.3.1 | 18 / 16 | |
| 1.2.7 | 20 / 15 | |
| 1.2.6 | 20 / 15 | |
| 1.1.2 | 3 / 11 | |
| 1.1.1 | 3 / 11 | |
| 1.1.0 | 3 / 11 | |
| 1.0.1 | 3 / 11 | |
| 1.0.0 | 3 / 11 |
v1.3.2
2 findingsThis version was published by a different npm account than previous versions on 2026-07-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.1
2 findingsThis version was published by a different npm account than previous versions on 2026-07-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.