@ant-design/icons

Build provenancecaution

No build attestation or trusted-publisher configuration was reported, so publication provenance is less independently verifiable despite the package's strong maintenance evidence.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations less transparent than they could be.

Workflow auditcaution

The single workflow was fully analyzed with no detected high-confidence findings or unsafe triggers, but all 3 action references are unpinned, weakening build reproducibility.