@xterm/headless

Build provenancecaution

No build attestation or trusted-publisher identity is available, leaving publication provenance less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Security policycaution

The repository has no published security policy, so the reporting and response process for vulnerabilities is not documented.

Token permissionscaution

Three workflows declare read-only permissions, while one CodeQL workflow has top-level write permissions. The broader workflow analysis found no dangerous patterns, but the write capability is still a minor permissions concern.

Version stabilitycaution

Version 6.0.0 is a stable major release rather than a prerelease, although the recent prerelease share of 1.0 indicates that some recent development has occurred in prerelease versions.