es-iterator-helpers

Build provenancecaution

The release has no attestation, but staged publishing with an identified approver provides some publishing control. The missing independently verifiable provenance remains a modest transparency gap.

Repo bus factorcaution

All 13 recent commits came from one contributor, leaving maintenance dependent on a single active person despite organization ownership.

Type declarationscaution

No type declarations are published. This is a minor integration gap for consumers who want static typing, but it does not by itself indicate abandonment or poor package health.

Workflow auditcaution

All seven workflows were analyzed with no audit findings or untrusted checkouts, and six use read-only permissions. However, all 10 analyzed action references are unpinned and one workflow has top-level write permissions, creating build-reproducibility and least-privilege concerns.