detective-typescript

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot verify how this release was produced. This is a transparency weakness, not evidence of maliciousness.

Repo bus factorcaution

One contributor made all 5 commits in the last 3 months, creating concentration risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and response expectations.

Type declarationscaution

No type declarations are published. This is a minor integration gap for consumers using TypeScript, but the package has clear usage documentation and exposes a focused API.

Workflow auditcaution

All three workflows use read-only permissions and the audit found no high- or medium-severity findings, but all 7 analyzed action references are unpinned, leaving workflow dependencies exposed to tag changes.