@lukeed/csprng

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence was collected, leaving release provenance less transparent.

Release historycaution

The package has only 3 releases and none in the last 12 months; its latest release was in March 2023, indicating a long maintenance gap. Its small, focused scope partly reduces the significance of infrequent releases.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the extended release gap and raising abandonment risk.

Security policycaution

The repository has no security policy, which weakens the documented process for reporting and handling vulnerabilities.

Workflow auditcaution

The single workflow was fully audited with no dangerous triggers, untrusted checkouts, or script injection, but both action references are unpinned and it has a high-confidence adhoc-packages finding for installing outside a lockfile. These are workflow hygiene concerns rather than severe risks.