@fullcalendar/core

Build provenancecaution

No build attestation or trusted-publisher provenance was detected. This limits release transparency, although the package has an active source repository and regular release history.

Repo package mentioncaution

The repository name does not match @fullcalendar/core and its README does not mention the package, creating some identity ambiguity. The package's README describes it as a shared core-types package in a monorepo, which partly explains the mismatch but does not remove the concern.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap.

Security policycaution

No security policy was found in the repository. This weakens vulnerability-reporting transparency, though it is not evidence of unsafe code by itself.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or write permissions, but all 4 of 4 action references are unpinned. That leaves avoidable workflow supply-chain risk.