@profoundlogic/hogan
2
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
profoundlogic
Keywords
mustachetemplate
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:morgan | AI (typosquat): This is a scoped fork of hogan.js (Mustache template engine), not a typosquat of morgan. The name similarity is coincidental and the package is clearly identified as a ProfoundLogic fork. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is the core template compilation mechanism of Hogan.js. This is intentional and well-documented behavior of the Mustache template engine, not malicious code execution. | ai | |
| phantom-deps | phantom-dep:nopt | AI (phantom-deps): nopt is a legitimate CLI dependency used by the hulk bin tool; not imported in the main module but used in the CLI entry point. Not a security concern. | ai |
v3.0.4
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.3
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.