← Home

glimpseui

npm Repository Homepage
3
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

haza

Keywords

macoslinuxwindowswebviewnativeuiwebkitwkwebviewwebview2gtkswiftguiagentdialogpromptoverlaypi-package

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:silent-process-exec AI (semgrep): Fires in examples/companion/index.ts — example code showing companion process spawning, not library runtime. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same example file; not in library runtime code path. ai
install-scripts install-script:postinstall AI (install-scripts): Native WebView binding (Swift/GTK/.NET) legitimately needs postinstall to build/fetch platform binaries. ai

Versions (showing 3 of 3)

Version Deps Published
0.8.1 0 / 0
0.8.0 0 / 0
0.3.1 0 / 0