@dagrejs/dagre

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable despite the matching source repository and active project.

Repo bus factorcaution

Recent activity comes from only 2 contributors, with one responsible for about 82% of commits. The second active contributor and organizational ownership provide some compensation, but contribution concentration remains a maintenance risk.

Repo toolingcaution

The repository uses TypeScript, npm scripts, esbuild, and Make, demonstrating a reproducible build setup, but no security scanning tools were detected.

Security policycaution

The repository has no published security policy, which weakens vulnerability-reporting transparency and response expectations.

Token permissionscaution

The only workflow lacks top-level token permissions. No write permissions were observed, but explicitly declaring least-privilege permissions would provide stronger assurance.