ioredis

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, leaving the connection between the published artifact and its source build less transparent; the active matching repository partly compensates.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected. The repository's security policy and clean workflow analysis provide partial compensating evidence, so this is a modest hygiene gap.

Token permissionscaution

None of the six workflows declares top-level token permissions, so least-privilege intent is not explicit; however, no workflow declares top-level write access, limiting the observed concern.