@zag-js/date-picker

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, so consumers have less evidence connecting the published artifact to the source build.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/date-picker. A monorepo mismatch is ordinary, but the missing package reference leaves package ownership less transparent.

Repo toolingcaution

The project uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing disclosure transparency even though the active project provides other maintenance evidence.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, or auditor findings, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions.