@faststore/core
7
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
tlgimeneshellofannyfilipewllucasfjportelaeduardo.formigaguieevcicazevedovictorhmplariciamotaemersonlaurentino
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@qwik.dev/partytown | AI (dependencies): @qwik.dev/partytown is the official successor to @builder.io/partytown after the project transferred to the Qwik org; expected swap for this package. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Config-file-referenced formatter; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:fs-extra | AI (phantom-deps): Config-file-referenced tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@antfu/ni | AI (phantom-deps): Config-file-referenced tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:css-loader | AI (phantom-deps): Config-file-referenced build tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:sass-loader | AI (phantom-deps): Config-file-referenced build tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Framework-scoped type package loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:autoprefixer | AI (phantom-deps): Config-file-referenced PostCSS plugin; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:style-loader | AI (phantom-deps): Config-file-referenced build tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@builder.io/partytown | AI (phantom-deps): Referenced in partytown script; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@vtex/prettier-config | AI (phantom-deps): Config-file-referenced formatter config; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@graphql-codegen/typescript | AI (phantom-deps): Config-file-referenced codegen tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@graphql-codegen/typescript-operations | AI (phantom-deps): Config-file-referenced codegen tooling; stable false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:@lhci/cli | AI (phantom-deps): CLI tool used in lhci script; not directly imported in source. | ai | |
| phantom-deps | phantom-dep:use-sync-external-store | AI (phantom-deps): Runtime dep used transitively; phantom-dep heuristic false positive. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established VTEX monorepo package; README link density is typical for a framework docs page. | ai | |
| phantom-deps | phantom-dep:sass | AI (phantom-deps): Build tooling dependency referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:sharp | AI (phantom-deps): Known implicit runtime/binary dependency for Next.js image optimization. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): Build tooling referenced in config files; stable false positive. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Standard CI-skip postinstall pattern for VTEX FastStore; stable across versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Webpack runtime boilerplate; standard bundler pattern. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Partytown web worker sandboxing pattern; expected usage. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @faststore/core package; not a typosquat of cors. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires in bundled Next.js server chunks; not malicious payload. | ai |