@zag-js/pin-input

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the otherwise active project evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/pin-input, so the exact package-to-repository relationship is less transparent; the organization backing partly offsets this concern.

Repo toolingcaution

The repository uses established TypeScript and bundling tools, but no security-scanning tools were detected; this is a modest transparency and hygiene gap.

Security policycaution

No repository security policy was found, reducing documented guidance for reporting vulnerabilities; this is a hygiene concern rather than evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no detected audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating avoidable maintenance and workflow-integrity risk.