eslint-plugin-import

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving the artifact-to-source publishing path less transparent than it could be.

Dependency profilecaution

The package declares 19 runtime dependencies and 44 development dependencies, a moderately substantial profile for a linting plugin. This is manageable but increases maintenance surface.

Release historycaution

The package has 136 releases since March 2015, but none in the last 12 months and the latest registry release was about 15 months ago. Active repository commits partly compensate, but the release gap remains a maintenance concern.

Workflow auditcaution

All 7 workflows were analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection sinks. However, all 21 action references are unpinned, several jobs install packages outside a lockfile, and one workflow grants top-level write access, creating build-integrity hygiene concerns.