@inversifyjs/core

Build provenancecaution

No build provenance attestation or trusted-publisher identity was recorded, limiting publication transparency, though this does not by itself indicate an unsafe release.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @inversifyjs/core, so package ownership is less explicit even though the package is part of the linked monorepo.

Repo toolingcaution

The project uses Turbo, npm scripts, and TypeScript for builds, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All 11 workflows were analyzed and action references are pinned, but high-confidence findings include blanket GitHub App permissions and template-injection patterns; seven workflows also grant top-level write access. No untrusted checkouts or script-injection triggers were found, so this is caution rather than a standalone severe verdict.