@types/passport-oauth2

Build provenancecaution

No registry build attestation or trusted publisher identity is present, leaving publication provenance less transparent even though repository activity and organization backing provide compensating project evidence.

Release historycaution

The package has existed for about 9 years with 19 releases, but its latest release was about 15 months ago and there were no releases in the last 12 months. The active source repository partly compensates for this because type packages may only change when definitions need updates.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write permissions; two omit top-level permissions, which is a minor workflow-hygiene gap but not a severe risk.