@types/prismjs

Build provenancecaution

No build attestation or trusted-publisher identity is present, which limits publication transparency, but this is a minor gap alongside the package's otherwise strong project evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @types/prismjs, so the linkage is less transparent; the package README does point to the specific DefinitelyTyped type directory, partly compensating for this monorepo mismatch.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts, script injection, top-level write permissions, or unpinned action uses. Four medium-confidence template-injection findings remain hygiene concerns, but no dangerous trigger-and-sink combination is shown.