@jest/globals

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded. The package remains well supported by active repository evidence, but artifact origin is less independently verifiable.

Repo bus factorcaution

One contributor made about 96% of the 73 recent commits, creating concentration risk. The organization-owned project and two other active contributors partly compensate, but the imbalance remains a maintenance concern.

Repo toolingcaution

The repository uses several build tools, but no security-scanning tools were detected. This is a modest transparency and hygiene gap rather than evidence of abandonment.

Workflow auditcaution

All 11 workflows were analyzed with no failed files, no unpinned action references, and no untrusted checkouts or script injection. The high-confidence use-trusted-publishing finding indicates long-lived registry credentials instead of short-lived credentials, which warrants caution.