@modern-js/node-bundle-require

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This is a transparency gap, but the package has strong independent release and repository activity that partly offsets it.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @modern-js/node-bundle-require, so the package's connection to the linked monorepo is less transparent. The mismatch is plausible for a monorepo sub-package but still warrants caution.

Repo toolingcaution

The project uses build tooling, but no security-scanning tools were detected. That is a modest assurance gap, partially offset by the active organization-backed project and workflow audit.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear. This lowers transparency but is not by itself evidence of abandonment.

Workflow auditcaution

All 10 workflows were analyzed with no untrusted checkouts, script injection, high-severity findings, or unpinned action references. Six high-confidence low-severity adhoc-package findings indicate some workflows install packages outside a lockfile, a hygiene concern rather than a severe release risk.