@polkadot/apps-config

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot verify how this artifact was produced. This is a transparency gap, though it is not evidence of unsafe behavior by itself.

Dependency profilecaution

The package declares 47 runtime dependencies, including many ecosystem-specific type and API packages. That is consistent with a central configuration package but creates a relatively broad dependency surface.

Repo issue activitycaution

The repository received 33 new issues and 3 new pull requests in the last month, with 5 pull requests merged. This shows ongoing interaction, although the absence of closed issues in that period suggests backlog pressure.

Repo toolingcaution

The repository uses TypeScript, webpack, and npm scripts for builds, but no security-scanning tooling was detected. The missing scanning layer is a modest hygiene gap.

Security policycaution

The repository has no published security policy. That makes vulnerability-reporting expectations less transparent, but it does not by itself indicate abandonment or unsafe code.