@upsetjs/venn.js

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This lowers publication transparency, though it is not by itself evidence that the release is unsafe.

Release historycaution

The package has nine releases since June 2020, but no releases in the last 12 months and its latest registry release was in November 2024. That is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the long gap since the latest registry release, this raises concern about current maintenance responsiveness.

Security policycaution

No repository security policy was found. This is a transparency gap, although it is less significant for a small library than for a service handling sensitive data.

Workflow auditcaution

All three workflows were analyzed and none uses untrusted checkout or injection-triggering workflows, but all 15 action references are unpinned. High-confidence template-injection findings are hygiene concerns here without a matching dangerous trigger, while trusted publishing and ad hoc package installation warrant additional caution.