jasmine-core

Build provenancecaution

No build attestation, trusted publisher, or staged publishing was detected, so consumers have less evidence connecting the published artifact to its source build.

Repo bus factorcaution

Recent activity is highly concentrated: one contributor made 36 of 37 commits, so maintenance continuity depends heavily on a single person despite a second contributor remaining active.

Repo package mentioncaution

The repository name does not match jasmine-core and its README does not mention the package, so the package-to-repository relationship is less transparent, although a subpackage in a monorepo can explain this.

Repo toolingcaution

The project uses npm build tooling, but no security scanning tools were detected; this is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.