feed

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence was collected, leaving release provenance less transparent than it could be.

Lifecycle scriptscaution

A prepublish lifecycle script adds a release-time execution path that deserves some caution, although the signal does not show a broader install-time script set.

Repo toolingcaution

The project uses TypeScript, Vitest, and build tooling, supporting a structured development process, but no security scanning tools were detected.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The single workflow has no dangerous triggers or audit findings and completed fully, but all three action references are unpinned, weakening build reproducibility.