@lmdb/lmdb-linux-x64

Build provenancecaution

The release has no build attestation or trusted-publisher record, leaving publication provenance less transparent despite the otherwise active project.

Maintainerscaution

Only one account has registry publish access, which is a modest publishing-resilience concern. However, repository activity shows two active contributors, partly compensating for the narrow registry access list.

Repo package mentioncaution

The repository name does not match this platform-specific package and its README does not mention the package, creating some uncertainty about package-to-repository linkage. The package's platform-specific role makes a monorepo relationship plausible but does not remove that transparency gap.

Workflow auditcaution

All 27 analyzed action references are unpinned, which weakens workflow reproducibility. The reported cache-poisoning findings are low-confidence hygiene observations, while the high-confidence adhoc-package findings are low severity; no untrusted checkout or script-injection path was found.