@hapi/hoek

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. The otherwise clear package structure and repository link partly offset this transparency gap.

Repo bus factorcaution

All three recent commits came from one contributor, so short-term maintenance is concentrated. Organization ownership provides some handoff capacity, but no second recent contributor is shown.

Repo commit activitycaution

The repository had three commits in the last three months, showing recent activity, but only one active maintainer contributed them, limiting evidence of broad ongoing maintenance.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security scanning tool was detected; this is a modest transparency and hygiene gap rather than evidence of abandonment.

Workflow auditcaution

The sole workflow was fully analyzed with no audit findings or untrusted-code sinks, but its one action use is unpinned, leaving the build exposed to action-reference changes.