@sapphire/shapeshift

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable despite the package's otherwise established release history.

Repo bus factorcaution

One contributor made all three recent commits. Organization ownership partly compensates because maintenance can be handed off, but no second active contributor is shown.

Repo commit activitycaution

The repository recorded three commits in the last three months, so activity has not stopped, but the volume is modest for an actively maintained library.

Version stabilitycaution

Version 5.0.0 is a stable major release rather than a prerelease, although the recent prerelease share is high and warrants some caution around release maturity.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, all 11 action references are unpinned and one workflow grants top-level write permissions, creating a workflow supply-chain hygiene concern without an observed dangerous sink.