eslint-plugin-unicorn

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving release origin less independently verifiable than it could be.

Repo bus factorcaution

One contributor made 401 of 402 recent commits, so practical maintenance is highly concentrated despite a second active contributor; this raises continuity risk.

Repo toolingcaution

The project uses TypeScript and Babel for builds, showing established build tooling, although no security-scanning tool was detected.

Workflow auditcaution

All four workflows were analyzed with no audit findings, no untrusted checkout or script-injection sinks, and read-only or job-level permissions in several workflows. However, 13 of 16 action references are unpinned, which weakens reproducibility and action supply-chain hygiene.