@shoppexio/storefront
Official JavaScript storefront SDK for Shoppex
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@shoppex/contracts | AI (dependencies): Scoped alias to org's own contracts package (npm:@shoppexio/contracts). | ai | |
| source-diff | net-exec-file:dist/shoppex.esm.js | AI (source-diff): Bundled fetch-based SDK client code, not a loader; matches package's HTTP SDK purpose. | ai | |
| source-diff | net-exec-file:dist/shoppex.umd.js | AI (source-diff): Same bundle as ESM build; standard SDK output. | ai | |
| provenance | publisher-changed | AI (provenance): Change is manual→GitHub Actions CI, a provenance improvement not a regression. | ai | |
| provenance | no-provenance | AI (provenance): Young SDK with no CI provenance setup yet; no other risk signals present. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 1.0.2 | 1 / 8 | |
| 1.0.1 | 1 / 8 | |
| 0.3.17 | 1 / 8 | |
| 0.3.2 | 0 / 3 | |
| 0.3.1 | 0 / 3 | |
| 0.3.0 | 0 / 3 | |
| 0.1.1 | 0 / 3 | |
| 0.1.0 | 0 / 3 |
v1.0.2
5 findings[Reject — re-review on republish] (prior reject: AI (provenance): Previous versions had gitHead; its removal alongside publisher change indicates changed/unverifiable publish environment.) This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed mid-lifecycle on a very new package with no track record; generalizes as a risk signal.) This version was published by a different npm account than previous versions on 2026-07-14. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
5 findings[Reject — re-review on republish] (prior reject: AI (provenance): Previous versions had gitHead; its removal alongside publisher change indicates changed/unverifiable publish environment.) This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed mid-lifecycle on a very new package with no track record; generalizes as a risk signal.) This version was published by a different npm account than previous versions on 2026-07-08. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.17
5 findings[Reject — re-review on republish] (prior reject: AI (provenance): Previous versions had gitHead; its removal alongside publisher change indicates changed/unverifiable publish environment.) This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed mid-lifecycle on a very new package with no track record; generalizes as a risk signal.) This version was published by a different npm account than previous versions on 2026-06-24. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.