@ethereumjs/util

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which limits verification of how the registry artifact was produced.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations less transparent than they could be.

Workflow auditcaution

All 27 workflows were analyzed without failed files or untrusted checkout/script-injection findings, but 90 of 96 action uses are unpinned and high-confidence secrets-inherit findings expose credentials broadly in a reusable workflow. Low-confidence cache-poisoning findings and one ad-hoc package installation add smaller hygiene concerns.