Notary record

@shopify/hydrogen@2026.4.6

npm · checked 21 Oct 2026, 23:16 UTC · checker 2026-10-19.2 · log index 941

Issued 21 Oct 2026, 23:16 UTC · @shopify/hydrogen@2026.4.6 · npm

quiet

Its install steps ran with decoy credentials in reach and touched nothing we watch.

Its install steps ran here, with decoy credentials in reach, and touched nothing we watch: no network, no credential files. That is evidence, not proof: code can wait for a different machine or run later, when it is used. Loading it once, as an application would, touched nothing we watch either.

The trace shows what a step attempted. A quiet trace is evidence, not proof.

Check another package

Phases

This record does not state its phases one by one; npm records from checker 2026-11-03.1 and Python records from 2026-11-04.3 on do.

Install steps

@shopify/hydrogen has no install step of its own.

1 of its 151 dependencies run one:

esbuild@0.28.2postinstall

What the install steps reached

No install step reached anything we watch.

Programs: esbuild, node
Credentials read: No credential file or variable was opened.
Credentials sent: No decoy left the box.

The record keeps what all the install steps reached together; it does not say which step did which.

First import

It was imported once, as an application would, and exited 0.

It reached nothing we watch.

Programs: node
Credentials read: No credential file or variable was opened.
Credentials sent: No decoy left the box.

Dependencies

151 of 151 installed, as npm would on linux x64 musl.

Show all 151

@babel/code-frame@7.29.7
@babel/compat-data@7.29.7
@babel/core@7.29.7
@babel/generator@7.29.8
@babel/helper-annotate-as-pure@7.29.7
@babel/helper-compilation-targets@7.29.7
@babel/helper-create-class-features-plugin@7.29.7
@babel/helper-globals@7.29.7
@babel/helper-member-expression-to-functions@7.29.7
@babel/helper-module-imports@7.29.7
@babel/helper-module-transforms@7.29.7
@babel/helper-optimise-call-expression@7.29.7
@babel/helper-plugin-utils@7.29.7
@babel/helper-replace-supers@7.29.7
@babel/helper-skip-transparent-expression-wrappers@7.29.7
@babel/helper-string-parser@7.29.7
@babel/helper-validator-identifier@7.29.7
@babel/helper-validator-option@7.29.7
@babel/helpers@7.29.10
@babel/parser@7.29.9
@babel/plugin-syntax-jsx@7.29.7
@babel/plugin-syntax-typescript@7.29.7
@babel/plugin-transform-modules-commonjs@7.29.7
@babel/plugin-transform-typescript@7.29.9
@babel/preset-typescript@7.29.7
@babel/template@7.29.7
@babel/traverse@7.29.10
@babel/types@7.29.8
@esbuild/linux-x64@0.28.2
@google/model-viewer@4.4.0
@jridgewell/gen-mapping@0.3.13
@jridgewell/remapping@2.3.5
@jridgewell/resolve-uri@3.1.2
@jridgewell/sourcemap-codec@1.6.0
@jridgewell/trace-mapping@0.3.31
@juggle/resize-observer@3.4.0
@lit-labs/ssr-dom-shim@1.6.0
@lit/reactive-element@2.1.2
@mjackson/node-fetch-server@0.2.0
@monogrid/gainmap-js@3.7.2
@napi-rs/lzma-linux-x64-gnu@1.5.1
@oxc-project/types@0.155.0
@react-router/dev@7.16.0
@react-router/node@7.16.0
@remix-run/node-fetch-server@0.13.3
@rolldown/binding-linux-x64-gnu@1.2.15
@rolldown/binding-linux-x64-musl@1.2.15
@rolldown/pluginutils@1.0.1
@rollup/rollup-linux-x64-gnu@4.64.12
@rollup/rollup-linux-x64-musl@4.64.12
@shopify/graphql-client@1.4.1
@shopify/hydrogen-react@2026.4.4
@types/estree@1.0.9
@types/trusted-types@2.0.7
@xstate/fsm@2.0.0
arg@5.0.2
ast-v8-to-istanbul@0.3.12
babel-dead-code-elimination@1.0.12
baseline-browser-mapping@2.11.30
browserslist@4.29.4
buffer-from@1.1.2
cac@6.7.14
caniuse-lite@1.0.30001818
chokidar@4.0.3
color-convert@1.9.3
color-name@1.1.3
color-string@1.9.1
color@3.2.1
confbox@0.3.1
content-security-policy-builder@2.3.0
convert-source-map@2.0.0
cookie@1.1.1
debug@4.4.3
dedent@1.7.2
detect-libc@2.1.2
electron-to-chromium@1.5.463
es-module-lexer@1.7.0
esbuild@0.28.2
escalade@3.2.0
estree-walker@3.0.3
events@3.3.0
exit-hook@2.2.1
exsolve@1.1.3
fdir@6.5.0
flame-chart-js@2.3.1
gensync@1.0.0-beta.2
graphql@16.14.2
immediate@3.0.6
is-arrayish@0.3.4
is-promise@2.2.2
isbot@5.2.2
js-tokens@10.0.0
js-tokens@4.0.0
js-tokens@4.0.0
jsesc@3.0.2
json5@2.2.3
lie@3.3.0
lightningcss-linux-x64-gnu@1.33.0
lightningcss-linux-x64-musl@1.33.0
lightningcss@1.33.0
lit-element@4.2.2
lit-html@3.3.3
lit@3.3.3
lodash@4.18.1
loose-envify@1.4.0
lru-cache@5.1.1
ms@2.1.3
nanoid@3.3.20
node-releases@2.0.59
p-map@7.1.1
pathe@1.1.2
pathe@2.0.3
pathe@2.0.3
picocolors@1.1.1
picomatch@4.0.7
pkg-types@2.4.0
postcss@8.5.31
prettier@3.9.10
promise-worker-transferable@1.0.4
react-dom@18.3.1
react-dom@19.3.1
react-refresh@0.14.2
react-router@7.16.0
react@18.3.1
react@19.3.1
readdirp@4.1.2
regexparam@2.0.2
rolldown@1.2.15
rollup@4.64.12
scheduler@0.23.2
scheduler@0.28.0
semver@6.3.1
semver@6.3.1
semver@6.3.1
semver@7.8.5
set-cookie-parser@2.7.2
simple-swizzle@0.2.4
source-map-js@1.2.2
source-map-support@0.5.21
source-map@0.6.1
three@0.183.2
tinyglobby@0.2.17
type-fest@4.41.0
update-browserslist-db@1.3.4
use-resize-observer@9.1.0
valibot@1.5.0
vite-node@3.2.4
vite@7.3.7
vite@8.3.5
worktop@0.7.3
yallist@3.1.1

Since the previous version

No comparison with an earlier version was made for this check.

Sandbox

Decoys presentStand-in networkTracer ebpf

network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user

Signature and transparency log

level: quiet
verdict: approved
reasonCode: ran_ok
keyId: 322a2536e0d5ec8e
algorithm: ed25519
checker: 2026-10-19.2
issuedAt: 2026-10-21T23:16:26Z
contentSha256: cba1b15671b8a06c14e026af43312f50fa987645be1221203a6ec30a57726618
contentSizeBytes: 1509021 (1.4 MB)
outputSha256: 1d8d517f76066913602ad2f02918093ba3f81a69fb07ba885647bc899fcf2614
log index: 941

Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.

Inclusion proof Checkpoint Key list

What this does and does not say

The claim is about the bytes, not the name.

The signature covers these exact bytes. Another version is another check.

A quiet trace is evidence, not proof.

Code that only runs later, when your app calls it, is out of reach.

A signature is not an endorsement.

It says what happened, not that the code is good.

Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.