@solid-primitives/static-store

Workflow auditdanger

All five workflows were analyzed, but all 22 action references are unpinned and the audit reported two high-confidence template-injection findings in the JSR publishing workflow. No untrusted checkout or script-injection trigger was reported, which limits the severity but does not remove the hygiene concern.

Build provenancecaution

No build attestation or trusted-publisher provenance is provided, which limits publication transparency, though this is not by itself evidence of poor maintenance.

Repo bus factorcaution

One contributor made about 82% of recent commits, creating concentration risk; the second active contributor provides partial organizational resilience.

Version stabilitycaution

Version 0.1.4 is not a stable major release, but it is not a prerelease and recent prereleases are a minority, so this is a modest maturity concern rather than a serious risk.