@types/estree

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded for this release. The package is a small declaration artifact with a transparent repository and no lifecycle scripts, which limits the practical concern but does not remove the transparency gap.

Repo package mentioncaution

The linked repository does not match the package name and does not mention @types/estree in its README. This is expected for a subpackage in the DefinitelyTyped monorepository, but it makes the package-to-repository mapping less explicit.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and none use untrusted checkouts or script injection. Medium-confidence template-injection findings are a workflow hygiene concern, but no high-severity findings were reported.