chalk

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, so consumers have less independently verifiable evidence about how this artifact was published.

Repo toolingcaution

The project uses TypeScript build tooling, but no security-scanning tools were detected; the repository's security policy provides some compensating process transparency.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or high-severity issues. However, both action references are unpinned, so their fetched revisions are less reproducible.