@yarnpkg/libzip

Build provenancecaution

No registry build attestation or trusted-publisher identity is present, reducing publication transparency, although this is not evidence of a maintenance failure by itself.

Dangerous workflowscaution

One workflow uses pull_request_target with an untrusted checkout, creating a meaningful CI exposure even though no script-injection workflows were detected.

Repo issue activitycaution

The repository continues to receive issues and pull requests, though none of seven new pull requests were merged in the measured month and the backlog is large.

Repo toolingcaution

The repository uses established build tools, but no security-scanning tools were detected, leaving a modest security-process gap.

Token permissionscaution

All 30 analyzed workflows lack top-level token permissions, and none declare read-only permissions; although no workflow has top-level write access, least-privilege configuration is not consistently explicit.