@parcel/logger

Build provenancecaution

No build attestation or trusted-publisher identity is present. This weakens release transparency, but the package has a long release history and an organizational repository, so it is a moderate gap rather than a severe health failure.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months. That is a meaningful maintenance concern despite recent registry releases and repository pushes.

Security policycaution

No repository security policy was found. This is a transparency gap for a widely used project, but it is not severe enough to outweigh the project's other maintenance evidence.

Workflow auditcaution

All 49 analyzed action references are unpinned, and high-confidence template-injection findings appear in the release workflow; high-confidence secrets-inherit findings also affect three workflows. The audit found no untrusted checkout or script-injection trigger, so these are workflow hygiene and release-security concerns rather than a standalone critical risk.