@types/canvas-confetti

Build provenancecaution

No build attestation or trusted-publisher information is present, which limits publication transparency but is not severe given the package's simple generated contents and active backing project.

Release historycaution

The package has 14 releases since 2018, but none in the last 12 months; the latest release was about 21 months ago. The underlying project activity partly offsets this for stable definitions.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkout or script-injection paths were found. Medium-confidence template-injection findings remain a minor hygiene concern, without dangerous triggers or broad write permissions.