@parcel/resolver-default

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, a significant recent maintenance warning despite the recent package release and repository push.

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent. This is a meaningful hygiene gap, not a standalone dependency verdict.

Repo package mentioncaution

The repository name does not match this subpackage and its README does not mention the package. The monorepo context makes the name mismatch ordinary, but the absent README mention leaves some package-to-repository linkage ambiguity.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout or script-injection trigger path, but all 49 action references are unpinned and high-confidence template-injection findings plus secrets inheritance affect release workflows.