@nivo/core

Build provenancecaution

The release has no build provenance attestation or trusted-publisher record, so consumers cannot verify how the published artifact was produced.

Release historycaution

The package has 89 releases and a long history, but it has had no registry release in the last 12 months; the latest release was over 16 months ago. Active repository work partly offsets the publishing gap, but not completely.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, script injection, or audit findings, but all 15 action references are unpinned. That leaves avoidable build-integrity exposure.