@googlemaps/js-api-loader

Build provenancecaution

No build attestation or trusted-publisher identity is provided, leaving publication provenance less transparent than it could be; the repository's release workflow offers some compensating context.

Repo bus factorcaution

All recent commits came from one contributor. Organizational ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating unusually limited direct commit activity despite the recent release and pull-request merges.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, but 13 of 14 action references are unpinned and the audit flags high-confidence bot-condition and trusted-publishing concerns; the low-confidence cache findings are hygiene only.