data-view-buffer

Build provenancecaution

No build attestation or trusted-publisher identity is present. This reduces publication transparency, although it is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts. These are not automatically unsafe, but they add release-time execution surface that merits caution when provenance is limited.

Release historycaution

Only three releases have been published, with none in the last 12 months; the latest release was nearly two years ago. This raises maintenance caution, though the package may be stable and its repository was pushed more recently.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance.

Workflow auditcaution

All six analyzed workflows completed the audit with no reported findings and five use read-only permissions, but all six action references are unpinned, leaving a workflow reproducibility gap.