@ant-design/colors

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Lifecycle scriptscaution

The package runs a prepare script during installation, which adds execution during dependency setup and warrants some caution even though compiled JavaScript is included.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, a meaningful sign that maintenance has recently slowed.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less clear.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, and permissions are scoped in two workflows. However, all seven action references are unpinned and a high-confidence medium-severity secrets-inherit finding broadens credential access.