@ethersproject/base64

Build provenancecaution

No build attestation or staged-publishing provenance was observed, leaving the artifact's build origin less transparent. This is a supply-chain transparency gap, but it is not evidence that the release is unsafe by itself.

Release historycaution

The package has 37 releases over roughly seven years, but none in the last 12 months. That long-term history is reassuring, while the recent publishing pause lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months. This is a meaningful maintenance warning, although the release notes show this version was a deliberate security update.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in the README, which creates some uncertainty about package-to-repository linkage. The package is part of an organization-backed ethers repository, which partly compensates for the monorepo-style name mismatch.

Workflow auditcaution

All 21 analyzed action references are unpinned, and a high-confidence low-severity finding reports an ad hoc package installation outside a lockfile. The audit found no untrusted checkouts, injection sinks, or write-wide permissions, limiting the impact to workflow hygiene.