@hapi/topo

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded. This reduces publication transparency, but it is not severe enough to outweigh the repository and release evidence.

Repo bus factorcaution

All two recent commits came from one contributor, giving a 100% top-contributor share. Organization backing partly compensates for this concentration, but the recent activity base remains narrow.

Repo toolingcaution

The repository uses TypeScript and Vitest for build and test work. No security scanning tools were detected, which is a modest security-process gap rather than an abandonment signal.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or high- or medium-severity audit results. Its one action reference is unpinned, a minor reproducibility and supply-chain hygiene gap.