@stoplight/spectral-functions

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers have less independent evidence connecting the published artifact to its source build.

Dependency profilecaution

Twelve runtime dependencies create a meaningful transitive maintenance surface for a utility package, though the profile is not unusually large enough to indicate severe risk.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. Although a name mismatch can be normal for a monorepo, the absence of both signals creates uncertainty that this repository is the package's intended source.

Repo toolingcaution

The project uses TypeScript, npm scripts, and SWC for builds, but the collected repository tooling includes no security-scanning tools. That is a modest transparency and hygiene gap, not evidence of abandonment.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.