@enspirit/elo

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how this release was built.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance and abandonment concern despite the earlier release burst.

Repo toolingcaution

The project uses TypeScript, npm scripts, and esbuild, but no security scanning tools were detected, leaving security-oriented maintenance less transparent.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response expectations.

Workflow auditcaution

All eight workflow action references are unpinned, and a high-confidence audit found an ad hoc package install; one workflow also grants top-level write permissions, though no untrusted checkout or script injection was found.