eslint-module-utils

Build provenancecaution

No build attestation is present, so consumers have less independently verifiable evidence about how the artifact was produced; staged publishing provides some process control but does not replace provenance.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some identity ambiguity; this is partly explained by the organization-owned monorepo context but remains worth checking.

Workflow auditcaution

All seven workflows were analyzed and no untrusted checkout or script-injection path was found, but all 21 action references are unpinned and high-confidence ad hoc package installs were detected; one workflow also grants top-level write access.