ajv

Build provenancecaution

No build attestation, trusted publisher identity, or staged-publishing evidence is present, leaving artifact provenance less transparent than it could be.

Lifecycle scriptscaution

A prepublish lifecycle script is present, which adds build or publication-time execution behavior and warrants some review, although it is not reported as an install script.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a significant maintenance warning. Recent releases and a recent repository push partly offset the concern but do not remove it.

Token permissionscaution

Neither workflow declares top-level token permissions, so the effective permissions are less explicit than ideal; however, neither workflow requests top-level write access.