@vue-storefront/commercetools-theme
My awesome Vue Storefront project
1
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
wojciechsikorampietrusinskifilrakfifciuuandre3000lukasborawskilaran01bloodf
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:nuxt | AI (phantom-deps): Nuxt is a config-registered framework; not directly imported in source files is expected. | ai | |
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): core-js is a known implicit runtime polyfill; not directly imported is expected. | ai | |
| phantom-deps | phantom-dep:nuxt-i18n | AI (phantom-deps): Nuxt module registered via nuxt.config.js, not directly imported. | ai | |
| phantom-deps | phantom-dep:@nuxtjs/pwa | AI (phantom-deps): Nuxt module registered via nuxt.config.js, not directly imported. | ai | |
| phantom-deps | phantom-dep:vue-scrollto | AI (phantom-deps): Nuxt plugin registered via config, not directly imported. | ai | |
| phantom-deps | phantom-dep:@storefront-ui/vue | AI (phantom-deps): UI library registered via Nuxt config, not directly imported. | ai | |
| phantom-deps | phantom-dep:@nuxtjs/google-fonts | AI (phantom-deps): Nuxt module registered via config, not directly imported. | ai | |
| phantom-deps | phantom-dep:@vue-storefront/nuxt | AI (phantom-deps): Same-org Nuxt module; config-registered pattern. | ai | |
| phantom-deps | phantom-dep:cookie-universal-nuxt | AI (phantom-deps): Nuxt module registered via config, not directly imported. | ai | |
| phantom-deps | phantom-dep:@vue-storefront/middleware | AI (phantom-deps): Same-org package; config-registered pattern. | ai | |
| phantom-deps | phantom-dep:@vue-storefront/nuxt-theme | AI (phantom-deps): Same-org Nuxt theme module; config-registered pattern. | ai | |
| phantom-deps | phantom-dep:@vue-storefront/commercetools | AI (phantom-deps): Same-org integration package; config-registered pattern. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 1.4.4 | 14 / 11 |
v1.4.4
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.