@hg-storefront/gift
A collection of React hooks and plugin configuration for managing gift functionality in the Hemglass storefront.
30
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
haustech
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:index-VB1hK3Ew.mjs | AI (source-diff): Same bundle as CJS counterpart; same rationale. | ai | |
| source-diff | obfuscated-file:browser-ponyfill-DhRrEg23-CAvYPDXg.js | AI (source-diff): Fetch polyfill chunk from bundler; recognizable OSS code, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:browser-ponyfill-DSfu_D2S-VYSU-KPM.js | AI (source-diff): Duplicate fetch polyfill chunk; same rationale as above. | ai | |
| source-diff | net-exec-file:index-CgU7xgEY.js | AI (source-diff): Network calls are fetch API usage in a storefront component; dynamic code is React internals, not a dropper. | ai | |
| source-diff | obfuscated-file:index-CgU7xgEY.js | AI (source-diff): Standard Vite/Rollup bundle containing React and OSS libraries; minification is expected for this package. | ai | |
| source-diff | obfuscated-file:index-VB1hK3Ew.mjs | AI (source-diff): ESM build artifact of the same bundle; minification expected. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Fires on bundled axios/graphql client code; not malicious obfuscation, stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@hg-storefront/types | AI (phantom-deps): Same-org types package; phantom-dep false positive for type-only dependencies. | ai | |
| typosquat | typosquat.levenshtein:got | AI (typosquat): Scoped package @hg-storefront/gift; the 'gift' name is clearly domain-specific, not a typosquat of 'got'. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 1.0.2 | 1 / 0 | |
| 1.0.1 | 1 / 0 | |
| 1.0.0 | 1 / 0 | |
| 0.0.33 | 1 / 0 | |
| 0.0.31 | 1 / 0 | |
| 0.0.30 | 1 / 0 | |
| 0.0.29 | 1 / 0 | |
| 0.0.28 | 1 / 0 | |
| 0.0.27 | 1 / 0 | |
| 0.0.26 | 1 / 0 | |
| 0.0.25 | 1 / 0 | |
| 0.0.24 | 1 / 0 | |
| 0.0.23 | 1 / 0 | |
| 0.0.22 | 1 / 0 | |
| 0.0.21 | 1 / 0 | |
| 0.0.20 | 1 / 0 | |
| 0.0.19 | 1 / 0 | |
| 0.0.17 | 1 / 0 | |
| 0.0.16 | 1 / 0 | |
| 0.0.15 | 1 / 0 | |
| 0.0.14 | 1 / 0 | |
| 0.0.13 | 1 / 0 | |
| 0.0.12 | 1 / 0 | |
| 0.0.11 | 1 / 0 | |
| 0.0.10 | 1 / 0 | |
| 0.0.9 | 1 / 0 | |
| 0.0.8 | 1 / 0 | |
| 0.0.6 | 1 / 0 | |
| 0.0.5 | 1 / 0 | |
| 0.0.4 | 1 / 0 |