@types/oauth

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less transparent, although this is not by itself evidence of an unhealthy release.

Release historycaution

The package has existed since 2018 but has had no release in the last 12 months, indicating a slower release cadence. Active repository work partly compensates because type definitions may not need frequent releases.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @types/oauth, creating some ownership ambiguity. The package README explicitly points to the corresponding DefinitelyTyped types/oauth location, which partly addresses that concern.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkouts, script injection, or top-level write permissions were found. Four medium-confidence template-injection findings remain as workflow hygiene concerns.