@orval/mock

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, which is a transparency gap, but the active repository and release history provide compensating maintenance evidence.

Repo package mentioncaution

The repository name does not match @orval/mock and its README does not mention that package, so the package-to-repository link is less transparent than ideal; the broader repository structure still supports that it is a monorepo source.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts or script-injection findings, but all 23 action references are unpinned and two high-confidence template-injection findings remain. The high-confidence trusted-publishing findings also indicate registry publishing uses longer-lived credentials rather than short-lived trusted credentials; the low-confidence cache finding is only a hygiene concern.