@vimeo/player

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing publication transparency, although the repository's workflow audit found pinned actions and no untrusted checkout path.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern even though registry releases continued.

Repo issue activitycaution

The repository saw two new issues but no closed issues or merged pull requests in the last month, offering little evidence of recent issue resolution.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection paths and all 17 action references pinned. The audit also reported a high-severity, low-confidence cache-poisoning pattern and high-confidence trusted-publishing usage, so workflow hygiene is not risk-free.