@zag-js/date-utils

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, so consumers receive limited evidence about how the artifact was produced. This is a supply-chain transparency gap, partly offset by the active organization-backed project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/date-utils, which is a transparency caution. The organization-owned repository and package's monorepo-style scope provide partial context for a subpackage mismatch.

Repo toolingcaution

The project uses established build tooling including TypeScript, Vite, tsup, SWC, and esbuild. No security scanning tools were detected, leaving a modest process gap.

Security policycaution

No repository security policy was found. This is a transparency and reporting-process gap, though the active repository and workflow audit provide some compensating evidence.

Workflow auditcaution

All 3 workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, 8 of 9 action references are unpinned and one workflow grants top-level write access, creating a workflow-hygiene caution without a corroborating untrusted trigger.