@simple-libs/stream-utils

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less transparent; this is a meaningful but not decisive gap alongside the active repository evidence.

Repo bus factorcaution

All six recent commits came from one contributor, creating a real continuity risk; organization ownership partly compensates because maintenance can be handed off.

Repo toolingcaution

The project uses TypeScript, Vite, and npm scripts, showing a defined build process, but no security-scanning tooling was detected.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities; this is a hygiene gap rather than evidence of abandonment.

Workflow auditcaution

All four workflows were analyzed without dangerous triggers or audit findings, but all 26 action references are unpinned, weakening reproducibility and update integrity. Missing top-level permissions blocks are not a concern here because no top-level write permissions were found.