@types/whatwg-mimetype

Build provenancecaution

No build attestation or trusted-publisher identity is available, which limits publication transparency. This is a caution rather than a severe concern because the package is a small declaration artifact backed by an active repository.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write access. Two workflows omit top-level permissions, leaving a modest configuration gap but no observed write-enabled workflow.