better-ccflare

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication and artifact origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer is not backed by an organization-owned project. The 17 active repository contributors partly offset that concentration.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no repository security-scanning tools were detected. The missing scanning is a minor hygiene gap given the otherwise active project.

Workflow auditcaution

All 9 workflows were analyzed with no untrusted checkout or script-injection findings, and the workflow_run trigger has no reported sink. However, all 26 action references are unpinned, three workflows grant top-level write permissions, and high-confidence template-injection findings affect release workflows; the low-confidence cache findings are hygiene only.