@ng-bootstrap/ng-bootstrap

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable; the established repository and release history provide some compensating transparency.

Repo bus factorcaution

One contributor made 100% of the recent commits, creating a concentrated bus factor; organization ownership provides some ability to hand maintenance off but does not show that a second contributor is currently active.

Repo commit activitycaution

Eleven commits in three months show current work, but all were made by one active maintainer, limiting evidence of broad maintenance capacity.

Repo toolingcaution

The repository uses TypeScript, Rollup, and npm scripts, showing a defined build process, but no security-scanning tooling was detected.

Security policycaution

No repository security policy was found, which weakens vulnerability-reporting transparency for a widely used library.