@zag-js/utils

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent despite the otherwise strong project activity.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @zag-js/utils. This is plausible for a monorepo sub-package, but the missing explicit reference modestly reduces package-to-repository transparency.

Repo toolingcaution

The project uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling, but no security-scanning tools were detected. The missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found, so the process for reporting vulnerabilities is not documented. This is a maintenance and transparency gap, not evidence of an unsafe release.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write access. This weakens workflow reproducibility and least-privilege hygiene.