@parcel/watcher-linux-arm-glibc

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less verifiable, though the active organization-backed project provides compensating context.

Repo package mentioncaution

The repository name does not match this platform-specific package and its README does not name it, which creates some identity ambiguity; the package README nevertheless directly points to this repository, consistent with a monorepo subpackage.

Repo toolingcaution

The project uses established build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No security policy was found in the repository, reducing transparency for vulnerability reporting and maintenance expectations.

Workflow auditcaution

Both workflows were analyzed without untrusted checkouts or script-injection sinks, but all 21 action references are unpinned and the audit found a high-confidence trusted-publishing issue. The repeated cache-poisoning findings were low-confidence and therefore carry little weight.