@types/codemirror

Build provenancecaution

No build attestation or trusted-publisher provenance is present, but this is a transparency limitation rather than evidence of abandonment; the package otherwise has active organizational maintenance.

Repo package mentioncaution

The linked repository is a large monorepo and neither its name nor its README mentions @types/codemirror, which creates some package-to-repository linkage ambiguity despite the package README pointing to the correct DefinitelyTyped path.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkouts or script injections were found. Four medium-confidence template-injection findings are a minor workflow-hygiene concern, but there are no high-severity findings or broad write permissions.