@discordjs/opus

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how the release was produced. This lowers transparency but is not, by itself, evidence that the release is unsafe.

Release historycaution

The package has 15 releases over about 6 years, but none in the last 12 months and the latest release was about 20 months ago. That materially raises maintenance risk despite the established release history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This suggests current maintenance has slowed, although the repository is not archived and was pushed more recently.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear. This is a transparency gap, but the package has release notes documenting a security fix for this version.

Workflow auditcaution

All 8 analyzed action references are unpinned, which is a workflow hygiene weakness. The audit also reported low-confidence cache-poisoning patterns; no untrusted checkout or script-injection sink was found, so this does not constitute a severe workflow risk.