@zag-js/file-upload

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, but the active organization-backed repository and frequent releases partly compensate.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/file-upload. Although a name mismatch is normal for a monorepo, the absence of both identifiers makes package ownership less transparent.

Repo toolingcaution

The repository uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling. No security scanning tools were detected, leaving a modest process gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy. This weakens disclosure transparency, though it does not indicate abandonment by itself.

Workflow auditcaution

All 3 workflows were analyzed with no dangerous triggers, untrusted checkouts, script injection, or auditor findings. However, 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a workflow reproducibility and least-privilege weakness.