cmake-js

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers receive less evidence connecting the published artifact to its source build.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. A recent release partly offsets this, but the current pause raises maintenance risk.

Repo issue activitycaution

The repository has 35 open issues and five open pull requests, but recorded issue and pull-request activity was zero in the last month, which weakens evidence of active maintenance.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or dangerous untrusted sinks, but all four action references are unpinned, reducing build reproducibility and increasing update risk.