@zag-js/accordion

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving release origin less verifiable; the strong release and repository activity partly compensates but does not remove the transparency gap.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/accordion, so the package-to-repository relationship is less transparent; the monorepo context makes a name mismatch ordinary but does not resolve the missing mention.

Repo toolingcaution

The project uses established TypeScript and bundling tools, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency for reporting vulnerabilities and coordinating security response.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkout and script-injection sinks. However, 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a workflow hygiene caution without evidence of an exploitable combination.