canvas

Build provenancecaution

No build attestation or staged publishing is reported, so consumers have limited verifiable evidence about how the release artifact was produced.

Licensecaution

The artifact contains a license file, but it is detected as Unlicense while the manifest declares MIT. That mismatch creates avoidable legal and transparency uncertainty.

Repo toolingcaution

The project uses build tooling but reports no security-scanning tools. That is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear for a widely used native package.

Workflow auditcaution

Both workflows were analyzed without untrusted checkouts or script-injection findings, but all 16 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene concerns, not a severe risk here.