jest-config

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the relationship between source and published artifact less transparent.

Dependency profilecaution

The release has 23 runtime dependencies, which is substantial but consistent with a configuration package in the Jest toolchain rather than an isolated utility.

Repo bus factorcaution

Three contributors were active, but one made about 96% of the 73 recent commits. Organization backing partly offsets this concentration, though maintenance still depends heavily on one contributor.

Repo toolingcaution

The repository uses established build tools and has a build system, but no security-scanning tools were detected, leaving a modest security-hygiene gap.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkout or script-injection findings, and all 48 action references are pinned. The audit identifies high-confidence trusted publishing with long-lived registry credentials, which is a supply-chain hygiene concern.