@jest/fake-timers

Build provenancecaution

No build attestation or staged-publishing provenance is available, leaving publication origin less independently verifiable than it could be.

Repo bus factorcaution

Three contributors were active, but one contributor made about 96% of the 73 recent commits. Organization backing partly offsets this concentration, but it remains a maintenance-continuity concern.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention @jest/fake-timers. This is plausible for a monorepo sub-package, but the missing explicit association leaves some ownership ambiguity.

Workflow auditcaution

All 11 workflows were analyzed, none of 48 action references were unpinned, and no untrusted checkout or script-injection sink was found. The high-confidence use-trusted-publishing finding indicates long-lived registry credentials instead of short-lived credentials, which is a supply-chain hygiene concern.