httpxy

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this artifact was produced.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected in the repository.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations undocumented.

Version stabilitycaution

Version 0.5.5 is not a prerelease and recent releases contain no prerelease versions, though the 0.x major version leaves more room for breaking changes than a 1.x release.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, or top-level write permissions, and all eight action references are pinned. Each workflow has a high-confidence low-severity adhoc-packages finding because it installs a package outside a lockfile.