@ast-grep/napi-linux-x64-musl

Build provenancecaution

No build attestation or trusted publisher identity is recorded, leaving release origin less verifiable despite the active source project.

Repo package mentioncaution

The repository name does not match this platform package and its README does not mention it. This is common for a monorepo subpackage, but the absence of either match or mention leaves package ownership less transparent.

Repo toolingcaution

No build or security-scanning tooling was detected, leaving less evidence of automated build and security hygiene.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities are reported and handled.

Workflow auditcaution

All 78 analyzed action references are unpinned, and high-confidence trusted-publishing findings appear in release workflows; low-confidence cache findings are hygiene concerns rather than decisive evidence.