is-any-array

Build provenancecaution

No build attestation or trusted-publisher provenance is provided, leaving publication origin less transparent, but this is a moderate transparency gap rather than a standalone severe risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a maintenance caution despite the recent July push and February release.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools are reported; for this small package that is a modest hygiene gap.

Security policycaution

The repository has no security policy, reducing clarity for vulnerability reporting, although the package has no runtime dependencies and a small surface area.

Workflow auditcaution

Both workflows were analyzed without injection or high-severity findings, but both of the two action references are unpinned, so their fetched code can change over time.