@hapi/statehood

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which leaves publication origin less independently verifiable despite the package's otherwise established project signals.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, indicating a period of quiet maintenance; the recent release and organization backing partly offset this concern.

Repo toolingcaution

The repository reports no build tool and no security scanning tools, leaving limited automated assurance for a package with runtime dependencies.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Its one action use is unpinned, which is a minor reproducibility and dependency-hygiene weakness.