@uppy/utils

Shared utility functions for Uppy Core and plugins maintained by the Uppy team.

Latest 7.2.0

NPM

88%

Total Score

healthy

Healthy: active organizational maintenance and regular releases outweigh workflow pinning and package-linkage concerns.

Health Score Breakdown

Build provenance

The release has no build attestation, so consumers receive less independently verifiable publication provenance. The GitHub trusted publisher identity is a partial compensating signal, making this a modest transparency concern rather than a severe risk.

Repo package mention

The repository name does not match @uppy/utils and its README does not mention the package, so the package-to-source relationship is less explicit than ideal. The organization-owned monorepo context partly explains the mismatch but does not remove the transparency concern.

Workflow audit

All 6 workflows were analyzed with no untrusted checkout or script-injection findings, but 28 of 39 action uses are unpinned and the audit found five high-confidence adhoc-package findings. One workflow also grants top-level write access; without an untrusted trigger this remains a hygiene concern.