@hyperframes/producer
HTML-to-video rendering engine using Chrome's BeginFrame API
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@hyperframes/lint | AI (dependencies): Same-org monorepo sibling dependency. | ai | |
| phantom-deps | phantom-dep:@hyperframes/parsers | AI (phantom-deps): Same-org monorepo sibling, config-referenced. | ai | |
| phantom-deps | phantom-dep:wawoff2 | AI (phantom-deps): Referenced in config files for font processing; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@hyperframes/studio-server | AI (phantom-deps): Same-org dep declared for transitive use; phantom-dep heuristic false positive for this package. | ai | |
| source-diff | encoded-string-file:dist/distributed.js | AI (source-diff): Base64 string is entities package htmlDecodeTree data, bundled by Bun — legitimate and stable for this package. | ai | |
| source-diff | net-exec-file:dist/distributed.js | AI (source-diff): Network + dynamic require in esbuild bundle is standard bundler shim pattern, not dropper behavior. | ai | |
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Long base64 string is the entities library HTML decode tree, a well-known benign pattern. | ai | |
| source-diff | encoded-string-file:dist/public-server.js | AI (source-diff): Same entities HTML decode tree base64 string; benign and stable across versions. | ai | |
| source-diff | obfuscated-file:dist/distributed.js | AI (source-diff): Standard esbuild bundle output; long lines are minified JS, not obfuscation. Matches documented distributed rendering entry point. | ai | |
| phantom-deps | phantom-dep:@fontsource/montserrat | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/space-mono | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/eb-garamond | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/archivo-black | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/ibm-plex-mono | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/league-gothic | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/jetbrains-mono | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): Font/CSS tooling dependency; referenced in config, not directly imported — stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:puppeteer | AI (phantom-deps): Puppeteer used for headless Chrome rendering; loaded via config, not direct import — stable false positive. | ai | |
| phantom-deps | phantom-dep:linkedom | AI (phantom-deps): HTML rendering dep used indirectly; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@fontsource/inter | AI (phantom-deps): Font packages are runtime assets loaded by config, not direct imports — stable false positive for all @fontsource deps. | ai | |
| phantom-deps | phantom-dep:@fontsource/nunito | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/oswald | AI (phantom-deps): Font asset dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fontsource/outfit | AI (phantom-deps): Font asset dep; stable false positive. | ai |
Versions (showing 100 of 201)
| Version | Deps | Published |
|---|---|---|
| 0.6.22 | 19 / 13 | |
| 0.6.21 | 19 / 13 | |
| 0.6.20 | 19 / 13 | |
| 0.6.19 | 19 / 13 | |
| 0.6.18 | 19 / 12 | |
| 0.6.17 | 19 / 12 | |
| 0.6.16 | 19 / 12 | |
| 0.6.15 | 19 / 12 | |
| 0.6.14 | 19 / 12 | |
| 0.6.13 | 19 / 12 | |
| 0.6.12 | 19 / 12 | |
| 0.6.11 | 19 / 12 | |
| 0.6.10 | 19 / 12 | |
| 0.6.9 | 19 / 12 | |
| 0.6.8 | 19 / 12 | |
| 0.6.7 | 19 / 12 | |
| 0.6.6 | 19 / 12 | |
| 0.6.5 | 19 / 12 | |
| 0.6.4 | 19 / 12 | |
| 0.6.3 | 19 / 12 | |
| 0.6.2 | 19 / 12 | |
| 0.6.1 | 19 / 12 | |
| 0.6.0 | 19 / 12 | |
| 0.5.7 | 19 / 12 | |
| 0.5.6 | 19 / 12 | |
| 0.5.5 | 19 / 12 | |
| 0.5.4 | 19 / 12 | |
| 0.5.3 | 19 / 12 | |
| 0.5.2 | 19 / 12 | |
| 0.5.1 | 19 / 12 | |
| 0.5.0 | 19 / 12 | |
| 0.4.45 | 19 / 12 | |
| 0.4.44 | 19 / 12 | |
| 0.4.43 | 19 / 12 | |
| 0.4.42 | 19 / 12 | |
| 0.4.41 | 19 / 12 | |
| 0.4.40 | 19 / 12 | |
| 0.4.39 | 19 / 12 | |
| 0.4.38 | 19 / 12 | |
| 0.4.37 | 19 / 12 | |
| 0.4.36 | 19 / 12 | |
| 0.4.35 | 19 / 12 | |
| 0.4.34 | 19 / 12 | |
| 0.4.33 | 19 / 12 | |
| 0.4.32 | 19 / 12 | |
| 0.4.31 | 19 / 12 | |
| 0.4.30 | 19 / 12 | |
| 0.4.29 | 19 / 12 | |
| 0.4.28 | 19 / 12 | |
| 0.4.27 | 19 / 12 | |
| 0.4.26 | 19 / 12 | |
| 0.4.25 | 19 / 12 | |
| 0.4.24 | 19 / 12 | |
| 0.4.23 | 19 / 12 | |
| 0.4.22 | 19 / 12 | |
| 0.4.21 | 19 / 12 | |
| 0.4.20 | 19 / 12 | |
| 0.4.19 | 19 / 12 | |
| 0.4.18 | 19 / 12 | |
| 0.4.17 | 19 / 12 | |
| 0.4.16 | 19 / 12 | |
| 0.4.15 | 19 / 12 | |
| 0.4.14 | 19 / 12 | |
| 0.4.13 | 19 / 12 | |
| 0.4.12 | 19 / 12 | |
| 0.4.11 | 19 / 12 | |
| 0.4.10 | 19 / 12 | |
| 0.4.9 | 19 / 12 | |
| 0.4.8 | 19 / 12 | |
| 0.4.7 | 19 / 12 | |
| 0.4.6 | 19 / 11 | |
| 0.4.5 | 19 / 11 | |
| 0.4.4 | 19 / 11 | |
| 0.4.3 | 19 / 11 | |
| 0.4.2 | 19 / 11 | |
| 0.4.1 | 19 / 11 | |
| 0.4.0 | 19 / 11 | |
| 0.3.2 | 19 / 11 | |
| 0.3.1 | 19 / 11 | |
| 0.3.0 | 19 / 11 | |
| 0.2.5 | 19 / 11 | |
| 0.2.4 | 19 / 11 | |
| 0.2.3 | 19 / 11 | |
| 0.2.2 | 19 / 11 | |
| 0.2.1 | 19 / 4 | |
| 0.2.0 | 18 / 4 | |
| 0.1.15 | 18 / 4 | |
| 0.1.14 | 18 / 4 | |
| 0.1.13 | 18 / 4 | |
| 0.1.12 | 18 / 4 | |
| 0.1.11 | 18 / 4 | |
| 0.1.10 | 18 / 4 | |
| 0.1.9 | 18 / 4 | |
| 0.1.8 | 18 / 4 | |
| 0.1.7 | 18 / 4 | |
| 0.1.6 | 18 / 4 | |
| 0.1.5 | 18 / 4 | |
| 0.1.4 | 18 / 4 | |
| 0.1.3 | 18 / 4 | |
| 0.1.2 | 18 / 4 |
v0.1.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.