@zag-js/dom-query

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, leaving publication provenance less transparent. The package nevertheless has a matching license, substantial artifact contents, and an active source repository.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @zag-js/dom-query, so the package-to-repository relationship is not directly demonstrated. Because this is an organization monorepo, the mismatch may be ordinary, but it remains a verification gap.

Repo toolingcaution

The repository uses established TypeScript and bundling tools, but no security scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found. This weakens vulnerability-reporting transparency, though active releases and repository work provide compensating maintenance evidence.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout, script injection, or audit findings, but 8 of 9 action references are unpinned and one workflow grants top-level write access. Without an untrusted trigger or sink, this is workflow hygiene risk rather than a severe supply-chain signal.