@figspec/components

Workflow auditdanger

All three workflows were analyzed, but all nine action references are unpinned. A high-confidence template-injection finding and a workflow with top-level write permissions add supply-chain hygiene risk; the low-confidence cache finding is weaker evidence.

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, reducing publication transparency even though this is not evidence that the release is unsafe.

Maintainerscaution

Only one account has registry publish access. This does not prove abandonment, but it leaves limited publishing redundancy for a user-owned project.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer provides limited visible organizational backing.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, a concrete sign that maintenance may have slowed despite the recent release.