@emotion/sheet

Build provenancecaution

No build attestation or staged publishing evidence was provided, so consumers cannot verify how this artifact was produced. The package's established repository and release history provide some context but do not replace provenance.

Release historycaution

The package has 40 releases over about 8 years, but its latest registry release was over two years ago and there were no releases in the last 12 months. This materially raises staleness risk for a dependency.

Repo commit activitycaution

The repository recorded zero commits from zero active maintainers in the last three months, which weakens evidence of ongoing maintenance even though the repository itself is not archived.

Repo package mentioncaution

The repository name does not match this package and its README does not mention @emotion/sheet. This can be normal for a monorepo, but the missing package reference makes package-to-repository ownership less transparent.

Workflow auditcaution

Both workflows use read-only permissions and have no untrusted checkout or injection findings, but all 10 analyzed action references are unpinned. That leaves workflow builds exposed to changing upstream action code.