@ucast/mongo2js

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, limiting verification of how the artifact was produced.

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance concentrated and creating a meaningful continuity risk.

Security policycaution

The repository has no security policy, which leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings, and one scopes permissions at job level. However, all four action references are unpinned, creating a workflow supply-chain hygiene gap.