@stdlib/assert-has-tostringtag-support

Build provenancecaution

No build attestation or trusted-publisher provenance was found, leaving publication origin less independently verifiable. The established repository and organization backing provide partial context but do not replace provenance.

Repo bus factorcaution

All three recent commits came from one contributor, creating a genuine single-person maintenance concentration. Organization ownership partly offsets handoff risk, but does not remove it.

Repo toolingcaution

The repository uses a build tool, but no security-scanning tools were detected. The missing scanning is a transparency and maintenance gap, though not severe enough to make the package unfit.

Token permissionscaution

All 13 analyzed workflows lack top-level token permission declarations. No workflow declares top-level write access, but explicit least-privilege settings would provide stronger CI security hygiene.