@sideway/formula

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable than it could be.

Release historycaution

Only two releases exist over roughly 6 years, with no release in the last 12 months and a median interval of about 26 months. Active repository commits partly compensate, but the registry cadence remains a maintenance concern.

Repo toolingcaution

The project uses TypeScript and Vitest for build and test tooling, but no security-scanning tool was detected; the missing scan is a modest transparency gap.

Security policycaution

No security policy was found in the repository, leaving vulnerability reporting expectations undocumented.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, its one action reference is unpinned, so workflow reproducibility is weaker.