@a2ui/web_core

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving publication origin less verifiable. This is a supply-chain transparency gap, but it is outweighed by the repository's active maintenance and clean workflow audit.

Licensecaution

The package declares Apache-2.0 and includes a license file, but artifact detection also recognizes MIT, creating a license-text mismatch that should be clarified. The package is nevertheless clearly licensed.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates some package-to-source transparency concern. However, the organization-backed repository and package's substantial generated source tree are consistent with a monorepo layout.

Repo toolingcaution

The project uses npm scripts and TypeScript, but no security-scanning tools were detected. This is a limited repository hygiene gap, not evidence of unsafe code.

Security policycaution

No repository security policy was found. That reduces disclosure transparency, although the project's strong maintenance and workflow controls partly compensate.