@vitest/eslint-plugin

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded. This leaves release-origin transparency weaker than the otherwise healthy maintenance evidence.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected. The missing scanning is a modest hygiene gap, not evidence of abandonment.

Security policycaution

No repository security policy was found. That reduces disclosure transparency, although it is not by itself evidence that the package is unsafe to depend on.