@iconify-json/simple-icons

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, limiting verification of how the artifact was produced, though this is not evidence of a faulty release.

Repo bus factorcaution

One contributor made all 44 commits in the last 3 months, creating a meaningful continuity risk; organization backing partly compensates by allowing maintenance handoff.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, making package ownership less transparent; the monorepo structure partly explains the name mismatch but not the missing mention.

Repo toolingcaution

The project uses TypeScript, Vitest, Unbuild, and npm scripts, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.