cheap-ruler

Build provenancecaution

No build attestation or staged publishing is reported. This is a transparency and publication-integrity gap, but it is not by itself evidence that the release is unsafe.

Repo bus factorcaution

All one recent commit came from a single contributor, producing a 100% top-contributor share. This creates a real continuity concern, although the repository is owned by an organization that can potentially hand off maintenance.

Repo toolingcaution

The repository uses TypeScript, Rollup, and npm scripts, showing an established build setup, but no security scanning tools are reported. The missing scanning is a modest hygiene gap.

Workflow auditcaution

All workflows were analyzed successfully with no audit findings, no untrusted checkouts, no script injection, and no write token permissions. Both action references are unpinned, which is a supply-chain hygiene weakness, but there is no corroborating dangerous workflow behavior.