@chakra-ui/theme

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable, though this is a transparency gap rather than evidence of unsafe behavior.

Release historycaution

The package has existed for about seven years with 658 releases, but only one release occurred in the last 12 months, indicating a notably slower registry cadence.

Repo package mentioncaution

The linked repository is a monorepo whose name does not match this package and whose README does not mention it, so package ownership is less directly transparent; the matching organization provides partial context.

Repo toolingcaution

The project uses established TypeScript and bundling tools, but no security-scanning tools were detected; this is a modest process gap, not a standalone adoption blocker.

Workflow auditcaution

All three workflows were analyzed with no high-confidence findings, injection paths, or incomplete files. However, all nine action references are unpinned, and one workflow grants top-level write access, creating a workflow-reproducibility and least-privilege concern.