@jest/environment-jsdom-abstract

Build provenancecaution

No build attestation or trusted publisher provenance was reported, leaving artifact origin less independently verifiable despite the otherwise active project.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this package. The mismatch can be normal for a monorepo, but the lack of a README reference leaves some uncertainty that the repository is the intended source.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

All 11 workflows were analyzed, all 48 action references are pinned, and no untrusted checkout or script injection was found. The high-confidence use-trusted-publishing finding indicates registry publishing uses a long-lived token, so workflow supply-chain hygiene is not perfect.