@postman/tunnel-agent

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so release origin is less verifiable, though this is not evidence of maliciousness by itself.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, which weakens evidence of current maintenance capacity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear and modestly reducing transparency.

Workflow auditcaution

The only workflow has top-level write permissions and both action references are unpinned; the high-confidence adhoc-packages finding is low-severity hygiene, with no untrusted checkout or script injection detected.