@nestjs/cache-manager

Build provenancecaution

No build attestation or trusted-publisher identity is provided, leaving publication provenance less verifiable. This is a transparency gap, not evidence that the release is unsafe.

Lifecycle scriptscaution

The package declares a prepare lifecycle script, which adds install-time behavior and modest supply-chain exposure. No provided signal shows that this script is harmful, so the concern is limited.

Repo toolingcaution

The repository uses TypeScript, Vitest, npm scripts, and Vite with a build tool, but no security-scanning tools were detected. The missing scanning is a modest hygiene gap.

Security policycaution

The repository has no security policy. This reduces transparency about vulnerability reporting and response, but does not indicate abandonment or an unsafe release by itself.