highcharts

Build provenancecaution

No registry build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's broader maintenance evidence.

Workflow auditcaution

Both workflows were analyzed without audit findings or untrusted checkouts, but both grant top-level write permissions and 3 of 8 action references are unpinned, creating modest workflow-hygiene risk.