@translated/lara

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent, though this is a transparency gap rather than evidence of unsafe code.

Maintainerscaution

Six registry publishers exist, with four using the translated.net domain and two using Gmail accounts (giovannimoscati and mortyddt). The organization-backed ownership compensates for the small number of company-domain publishers, while the Gmail accounts are a minor account-hygiene caution.

Repo toolingcaution

TypeScript, Webpack, and npm build tooling are present. No security-scanning tools were detected, which modestly reduces maintenance assurance.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All four analyzed action references are unpinned, creating reproducibility and action-substitution risk. The only audit finding is low-confidence cache-poisoning hygiene in the publish workflow, so it does not independently warrant severe impact; workflows otherwise have no untrusted checkouts or script injection, and one scopes permissions at job level.