@fullcalendar/timegrid

Build provenancecaution

No build attestation or trusted-publisher provenance was present, so consumers cannot verify how this registry artifact was produced. This is a transparency gap, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match this package and its README does not mention @fullcalendar/timegrid, so the package-to-repository relationship is less directly transparent. The organization match provides some compensation but does not remove the gap.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, but no security scanning tools were detected. The build tooling is a positive; the missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found, reducing published guidance for reporting and handling vulnerabilities.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. All four action references are unpinned, which leaves dependency-fetch integrity weaker.