@jest/create-cache-key-function

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving the artifact's origin less independently verifiable despite the otherwise mature project evidence.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in the README, so package-to-repository ownership is less transparent even though the repository is the Jest monorepo.

Workflow auditcaution

All 11 workflows were analyzed with no unpinned actions or untrusted checkouts, but the audit identified trusted publishing that uses long-lived registry credentials, a supply-chain hygiene caution.