@elizaos/server

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less verifiable than it could be. This is a transparency gap, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @elizaos/server, so the package-to-source relationship is not clearly established by this signal. The mismatch is a caution even though monorepo subpackages commonly use different names.

Version stabilitycaution

Version 1.7.2 is a stable major release and is not a prerelease. The recent prerelease share is high at 90%, so release selection may require care despite this version being stable.

Workflow auditcaution

All 202 analyzed action references are pinned and no untrusted checkout or script-injection paths were found. However, only 30 of 60 workflows were analyzed, seven high-confidence template-injection findings and repeated secrets-inherit findings were reported, and one workflow grants top-level write access; these are meaningful workflow-hygiene concerns.