@zag-js/interact-outside

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a supply-chain transparency gap, though it is partly offset by the active organization-backed repository and established release history.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package. The organization-backed monorepo context makes a name mismatch ordinary, but the lack of a README mention leaves package ownership less explicit.

Security policycaution

The repository has no published security policy. That weakens vulnerability-reporting transparency, although the active repository and workflow audit provide some compensating evidence.

Workflow auditcaution

All three workflows were analyzed successfully with no detected injection or untrusted-checkout findings, and one workflow has top-level write permissions. However, 8 of 9 action references are unpinned, creating a workflow reproducibility and tampering risk.