core-js-compat

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable than it could be.

Maintainerscaution

Only one registry account has publish access. This is a real publishing continuity concern, although the linked repository shows active project work.

Repo bus factorcaution

Five contributors were active in the last three months, but the leading contributor made 79 of 84 commits, or about 94%, creating substantial continuity risk.

Repo toolingcaution

The project uses Babel and npm scripts for builds, but no security scanning tools were detected, leaving a modest tooling gap.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, all 38 action references are unpinned and one workflow grants top-level write permissions, creating workflow reproducibility and least-privilege concerns.