broker-factory

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how the registry artifact was produced.

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation, adding build-time execution beyond ordinary file consumption and a small supply-chain exposure.

Repo bus factorcaution

All 31 recent commits came from one contributor, leaving maintenance dependent on a single active person and creating a meaningful continuity risk.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected, leaving a modest transparency and assurance gap.

Workflow auditcaution

The sole workflow is fully analyzed with no trigger-to-untrusted-code finding, but all 3 action references are unpinned and it installs a package outside a lockfile; these are high-confidence hygiene weaknesses.