embla-carousel

Build provenancecaution

No build attestation or staged publishing is present, leaving release origin less independently verifiable. This is a transparency weakness but not evidence that the release is unsafe by itself.

Repo toolingcaution

The project uses established build tools and TypeScript, but no security-scanning tools were detected. The missing scanning is a modest process gap because other maintenance evidence is strong.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

The workflows were fully analyzed with no untrusted checkout or script-injection paths, but the release workflow has a high-confidence template-injection finding, all four action references are unpinned, and it grants top-level write access. The low-confidence cache-poisoning finding is only a hygiene concern.