@cspotcode/source-map-support

Build provenancecaution

No build provenance attestation or trusted-publisher metadata is present, limiting publication transparency. This is a modest confidence gap rather than a severe dependency risk.

Release historycaution

The latest release was over four years ago, with no releases in the last 12 months. That indicates materially slowed maintenance, though the package has a multi-year release history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing that maintenance has stalled rather than merely becoming less frequent.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a hygiene gap, not evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no high-confidence findings or unsafe-trigger sinks, but all three referenced actions are unpinned, weakening build reproducibility.