@zag-js/remove-scroll

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable, though this is a transparency gap rather than evidence of a bad release.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. The mismatch can be normal for a monorepo, but the absence of a README mention leaves package-to-repository linkage less explicit.

Repo toolingcaution

The repository uses established build tools including TypeScript, Vite, tsup, SWC, npm scripts, and esbuild. No security-scanning tools were detected, leaving a modest hygiene gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All three workflows were analyzed with no failed files, dangerous triggers, untrusted checkouts, script injection, or auditor findings. However, 8 of 9 action references are unpinned and one workflow has top-level write permissions, creating a workflow supply-chain hygiene gap.