@algolia/cache-common

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing publication transparency, although the active organization-backed project and pinned workflow references provide compensating evidence.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-repository relationship is less transparent; the monorepo context makes this a caution rather than a severe risk.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear; active maintenance partly offsets the transparency gap but does not remove it.