@types/sortablejs

Build provenancecaution

No build attestation or trusted-publisher metadata is present, which limits publication transparency, but the package is a simple declaration artifact and the repository provides substantial supporting evidence.

Repo package mentioncaution

The linked repository is a monorepo and neither matches the package name nor mentions it in the README, so the package-to-source association is less explicit than ideal.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkouts or script injections were found. Four medium-confidence template-injection findings remain, but template injection alone is a workflow-hygiene concern rather than a severe risk.