@quasar/app-webpack

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published artifact and its source less independently verifiable.

Repo bus factorcaution

One contributor made about 85% of recent commits, creating concentration risk, although 15 other contributors were active during the period.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which weakens package-to-source transparency; the organization-owned monorepo context makes this less concerning than an unexplained external repository.

Workflow auditcaution

All 16 workflows were analyzed with job-level permissions and no untrusted checkout or script-injection counts, but all 112 action references are unpinned and a high-confidence template-injection finding remains; low-confidence cache findings are hygiene concerns, while the high-confidence adhoc-package finding adds minor risk.