estree-util-scope

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap but not evidence that the release is unsafe.

Release historycaution

Only two releases exist across roughly two years, with one release in the last 12 months and a median interval of about 726 days. Recent repository activity partly offsets the sparse release cadence, but the history provides limited maturity evidence.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security-scanning tool was detected. For this small library, the missing scanner is a minor hygiene gap rather than a maintenance failure.

Workflow auditcaution

Both workflows were analyzed with no audit findings, no untrusted checkout or script-injection paths, and no top-level write permissions. However, all four action references are unpinned, which weakens build reproducibility and warrants a modest caution.