jest-environment-jsdom

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded for the artifact, leaving publication origin less independently verifiable even though other project evidence is strong.

Repo bus factorcaution

Recent activity is highly concentrated: one contributor made about 96% of the 73 commits, leaving a meaningful continuity risk despite two additional active contributors.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the package-to-repository linkage is less explicit; this is plausible for a monorepo subpackage but remains a transparency caution.

Workflow auditcaution

All 11 workflows were analyzed, all 48 action references are pinned, and no untrusted checkout or script injection was found. The high-confidence trusted-publishing finding indicates registry publication uses a long-lived token, which is a workflow hygiene concern.