chromium-edge-launcher

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent than it could be.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer reflects a genuinely narrow ownership base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating thin recent development activity despite the recent release.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tools were detected; this is a modest transparency and hygiene gap.

Workflow auditcaution

Both workflows use read-only permissions and have no untrusted checkout or script-injection findings. However, all seven action references are unpinned, and a high-confidence low-severity finding shows a workflow installs a package outside a lockfile.