@ethereumjs/common

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less independently verifiable despite the package's active repository and release history.

Security policycaution

The repository has no published security policy, which is a transparency gap for a package used in protocol and infrastructure software.

Workflow auditcaution

All 27 workflows were analyzed, but 90 of 96 action references are unpinned, several high-confidence findings involve inherited secrets, and one workflow installs a package outside a lockfile. Low-confidence cache findings are hygiene only, while the absence of untrusted checkouts and injection sinks limits the risk.