@ast-grep/napi-linux-x64-gnu

Build provenancecaution

No build attestation or trusted publisher identity was recorded, leaving release provenance less verifiable. The active repository and documented release process partly offset this gap but do not remove it.

Repo package mentioncaution

The repository name does not match this platform-specific package and its README does not mention the package, leaving some uncertainty about the artifact-to-source association despite the matching organization and binary-package structure.

Workflow auditcaution

All 78 analyzed action references are unpinned, and the audit reports high-confidence use of registry publishing credentials rather than short-lived trusted publishing; these are meaningful workflow supply-chain hygiene concerns. The cache-poisoning findings are low confidence and therefore add little weight.