@types/bun

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving release provenance less independently verifiable; the otherwise active, organization-backed project partly offsets this gap.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts, script injections, high-severity findings, or unpinned action references; the medium-confidence template-injection findings are workflow hygiene concerns, not independently severe here.