bser

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less independently verifiable despite the active organization-backed repository.

Repo package mentioncaution

The repository name does not match bser and its README does not mention the package. Although a monorepo can legitimately contain subpackages, this leaves the package-to-source relationship insufficiently demonstrated.

Workflow auditcaution

All 54 analyzed action references are unpinned, and the audit found high-confidence archived-action uses in the release workflow. Low-confidence unpinned-image findings are secondary, but together these are meaningful release-workflow hygiene weaknesses.