csp_evaluator

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, so consumers have limited independent evidence connecting the artifact to its source build.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful maintenance warning despite the recent registry release.

Repo issue activitycaution

The repository has 12 open issues and 4 open pull requests, but no issues or pull requests were opened or closed in the last month, providing weak evidence of current responsiveness.

Repo toolingcaution

The project uses TypeScript build tooling, but no security scanning tools are detected, leaving a security-maintenance gap for a security-focused library.

Token permissionscaution

The release workflow has top-level write token permissions, increasing the impact of a workflow compromise even though no dangerous workflow pattern was detected.