driver.js

Build provenancecaution

The release has no build attestation or trusted-publisher identity, leaving publication provenance less transparent despite the package's active maintenance.

Repo bus factorcaution

One contributor made 96% of the 50 recent commits, so continuity depends heavily on one person even though two other contributors remained active.

Repo toolingcaution

The project uses build tooling, but no security scanning tools were detected, leaving automated security coverage unclear.

Security policycaution

No repository security policy was found, reducing clarity about vulnerability reporting and response practices.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers, sinks, or findings, but all 4 action references are unpinned, weakening build reproducibility and update safety.