appdirsjs

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less transparent. This is a modest concern rather than evidence that the release is unsafe.

Repo bus factorcaution

All six recent commits came from one contributor, leaving maintenance dependent on a single person.

Repo toolingcaution

The project uses Make and TypeScript build tooling, but no security scanning tools were detected. The build setup is positive, while the missing scanning is a modest hygiene gap.

Security policycaution

The repository has no security policy, which reduces transparency about how vulnerability reports are handled.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all six action references are unpinned, so their exact revisions are not locked.