LimeHippo PDF Catalog uses locally bundled open-source software:

pdfmake 0.3.12
Source: https://github.com/bpampuch/pdfmake/tree/0.3.12
Distribution: npm pdfmake@0.3.12, build/pdfmake.min.js and build/pdfmake.js.
Readable source bundle is shipped alongside the minified build.
License: MIT. See assets/vendor/LICENSE-pdfmake.txt.

PDF.js 5.4.624
Source: https://github.com/mozilla/pdf.js/tree/v5.4.624
Distribution: npm pdfjs-dist@5.4.624, build/pdf.mjs and build/pdf.worker.mjs.
License: Apache-2.0. See assets/vendor/LICENSE-pdfjs.txt.

Noto Sans Regular, Bold, Italic and Bold Italic
Source: https://github.com/notofonts/noto-fonts/tree/main/hinted/ttf/NotoSans
License: SIL Open Font License 1.1. See assets/vendor/LICENSE-NotoSans.txt.
The workspace resources/fonts folder contains the source font files. The vendor
script creates a local vfs_fonts.js bundle with the fonts and their registration.

Manrope variable font (studio brand wordmark only)
Source: https://github.com/googlefonts/manrope
License: SIL Open Font License 1.1. See assets/brand/OFL.txt.
The hippo mark is the project's LimeHippo brand artwork.

Reproduction: the workspace package.json and pnpm-lock.yaml pin dependency versions;
scripts/vendor.mjs copies the distributed files and creates SHA-256 checksums.
No executable code, fonts, or PDF services are fetched from third parties at runtime.
Product media are loaded from the store's configured media URLs.
