embla-carousel-reactive-utils

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, reducing publication transparency, although the package otherwise has a clear active source project.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity has no organizational handoff signal to offset it.

Repo bus factorcaution

Three contributors were active recently, although the leading contributor made two-thirds of commits; the secondary contributors provide some mitigation but not a broad base.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-source relationship is not clearly established; its monorepo context partly explains the mismatch but does not remove the concern.

Repo toolingcaution

The project uses established build tooling and TypeScript, but no security-scanning tools were detected, leaving a modest transparency gap.