@nivo/colors

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the artifact was produced.

Release historycaution

The package has 54 releases since 2019, but none in the last 12 months and its latest registry release was about 16 months ago. Recent repository activity partly offsets the registry pause, but the release gap remains a maintenance concern.

Security policycaution

The linked repository has no security policy. This is a transparency gap, although the complete workflow audit found no concrete high- or medium-severity workflow issue.

Workflow auditcaution

Both workflows were analyzed successfully with no reported findings or untrusted checkouts, and one scopes permissions at job level. However, all 15 action references are unpinned, leaving a workflow supply-chain hygiene gap.