ip-range-check

Build provenancecaution

No build attestation or trusted-publisher configuration is present, reducing publication transparency. The simple artifact and clean repository evidence partly limit the concern.

Release historycaution

The package is over 11 years old and has only four releases, with a median interval of about 2 years and 10 months. A release in the last month and active repository commits partly compensate for the slow cadence.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, though the small package scope limits its practical weight.

Version stabilitycaution

Version 0.2.1 is not a prerelease, but the 0.x major version signals that API stability may be less established than for a mature 1.x release.

Workflow auditcaution

The workflow audit completed cleanly with no untrusted checkouts, injection findings, or excessive permissions, but both action references are unpinned. That leaves avoidable workflow supply-chain exposure.