@stoplight/spectral-parsers

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a transparency gap, not evidence that the release is unsafe.

Release historycaution

The package has seven releases over roughly five years, with no releases in the last 12 months and a latest release nearly two years old. Active repository work partly compensates, but the package release cadence is still slow.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about package-to-repository correspondence. The mismatch may reflect a monorepo, but the missing README mention warrants caution.

Repo toolingcaution

The project uses TypeScript, npm scripts, and SWC for builds, but no security-scanning tools were detected. The build setup is established while security automation is a minor gap.

Security policycaution

The repository has no security policy, which makes vulnerability-reporting expectations less clear for adopters.