@mapbox/vector-tile

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, so consumers cannot independently verify how this release artifact was produced.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful sign of slowed maintenance even though the package itself released recently.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tools were detected, leaving a modest transparency and hygiene gap.

Workflow auditcaution

The workflow audit completed fully with no dangerous triggers, untrusted checkouts, injection findings, or severity-bearing issues. However, both analyzed action references are unpinned, which weakens build reproducibility.