@zag-js/tabs

Build provenancecaution

No registry build attestation or trusted-publisher identity is present, limiting release reproducibility and publication transparency. The active organization-backed project and coherent artifact provide partial compensation.

Repo package mentioncaution

The repository name does not match @zag-js/tabs and its README does not mention the package, creating some uncertainty about package-to-repository linkage. The organization-backed monorepo context partly mitigates that concern but does not remove it.

Repo toolingcaution

The project uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response practices.

Workflow auditcaution

All three workflows were analyzed with no reported audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene risks, not a standalone severe threat.