embla-carousel-react

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, leaving the release origin less independently verifiable. This is a transparency gap, not evidence that the package is unsafe.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, creating some uncertainty about package-to-source ownership. The package README and monorepo-style file tree partly compensate for the mismatch.

Repo toolingcaution

The repository uses established build tooling including Rollup and TypeScript. No security-scanning tooling was detected, leaving a modest process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The audit found a high-confidence template-injection finding and a low-confidence cache-poisoning finding in the release workflow; because no untrusted checkout or relevant trigger was observed, these are workflow hygiene concerns rather than standalone severe risks. All four action references are unpinned, and one workflow grants top-level write access, adding further maintenance risk.