earcut

Build provenancecaution

No build attestation or staged-publishing provenance is reported, leaving the registry artifact's build origin less transparent despite the otherwise complete package contents.

Repo bus factorcaution

One contributor made about 95% of recent commits, which creates concentration risk, but the repository is owned by an organization with capacity to hand maintenance off.

Repo toolingcaution

The project uses TypeScript, Rollup, and npm scripts for its build, but no security scanning tools were detected; this is a modest hygiene gap rather than evidence of abandonment.

Workflow auditcaution

The single workflow was fully audited with no untrusted checkout, injection, or severity-rated findings. Both action references are unpinned, which weakens build reproducibility, while the lack of a top-level permissions block is not concerning on its own.