@emotion/memoize

Build provenancecaution

No build attestation or trusted-publisher provenance is reported for the release. This leaves publication origin less transparent, though it is not by itself evidence that the package is unsafe.

Release historycaution

The package has 19 releases over roughly 8 years, but none in the last 12 months and the latest release was about 2 years ago. This weakens confidence in ongoing package maintenance.

Repo commit activitycaution

There were zero commits from active maintainers in the last 3 months, a meaningful maintenance warning. Recent repository pushes and pull-request activity provide some compensating evidence, but do not restore normal release momentum.

Repo issue activitycaution

The repository received 8 new pull requests in the last month, although none were merged and no issues were closed. This shows attention but limited demonstrated throughput.

Workflow auditcaution

Both workflows use read-only permissions and the audit completed cleanly with no injection or high-severity findings. However, all 10 analyzed action references are unpinned, leaving avoidable workflow supply-chain exposure.