@mapbox/mapbox-gl-supported

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, so consumers cannot independently verify the release's build provenance.

Package scaffoldingcaution

A README is present and GitHub Releases are used, but neither the artifact nor repository has tests or a changelog. The missing tests are a maintenance-quality gap, although the release process provides some compensating transparency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last 3 months. This is a maintenance concern, although two pull requests were merged in the last month and a release was published recently.

Repo toolingcaution

The repository uses TypeScript and Rollup for builds, but no security scanning tools were detected. Build tooling is present, while security-process coverage is limited.

Token permissionscaution

The only workflow lacks top-level token permissions, so its default GitHub token scope is not explicitly minimized. No top-level write permissions were detected, which partially limits the concern.