@zag-js/collection

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication and artifact origin less independently verifiable.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/collection, so package-to-repository ownership is less transparent; the monorepo context partly explains the name mismatch but not the missing README mention.

Repo toolingcaution

The repository uses established build tools including TypeScript, Vite, tsup, SWC, npm scripts, and esbuild, but no security scanning tools were detected.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance unspecified.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions; this is a meaningful supply-chain hygiene weakness without an observed exploit path.