@sinonjs/samsam

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare install-time script adds some execution surface during installation. This is a modest supply-chain hygiene concern, though the available signals do not show that it is malicious or unusually complex.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful recent maintenance slowdown. The regular release history and recent repository push partly offset, but do not erase, this concern.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations. Its security scanning tools provide partial compensation but do not replace a policy.

Workflow auditcaution

The sole workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted-code sinks. However, all 11 action references are unpinned, weakening workflow reproducibility and update safety.