@zkochan/cmd-shim

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release origin less independently verifiable.

Maintainerscaution

Only one registry account has publish access, which is a publishing-resilience concern, although the repository is backed by an organization and actual repository activity shows three active contributors.

Repo bus factorcaution

Three contributors were active in the last three months, but one contributor made about 87% of commits, creating concentration risk; organization backing and two additional active contributors partly compensate.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Token permissionscaution

The only workflow lacks top-level token permissions, so its intended GitHub token access is less explicit than recommended; no write permissions were observed.