@ethersproject/contracts

Build provenancecaution

No build attestation or staged publishing is reported, leaving release provenance less transparent than it could be.

Release historycaution

The package has 63 releases over about 7 years, but none in the last 12 months; this suggests a mature but currently quiet release cadence.

Repo package mentioncaution

The repository name does not match this sub-package and its README does not mention the package, which makes ownership less explicit; the monorepo context makes the name mismatch alone ordinary.

Workflow auditcaution

All 21 analyzed action references are unpinned, and one workflow installs a package outside a lockfile; these are high-confidence hygiene concerns, but there are no untrusted checkouts, script injections, or write-token findings.