@profoundlogic/hogan
2
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
profoundlogic
Keywords
mustachetemplate
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:morgan | AI (typosquat): This is a scoped fork of hogan.js (Mustache template engine), not a typosquat of morgan. The name similarity is coincidental and the package is clearly identified as a ProfoundLogic fork. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is the core template compilation mechanism of Hogan.js. This is intentional and well-documented behavior of the Mustache template engine, not malicious code execution. | ai | |
| phantom-deps | phantom-dep:nopt | AI (phantom-deps): nopt is a legitimate CLI dependency used by the hulk bin tool; not imported in the main module but used in the CLI entry point. Not a security concern. | ai |