jest-matcher-utils

Build provenancecaution

No build attestation or trusted-publisher identity was recorded for the release, limiting publication transparency; this is partly offset by the active organization-backed repository and pinned workflow actions.

Repo bus factorcaution

One contributor made about 96% of the recent commits, creating concentration risk, although two additional contributors remained active and the repository is organization-owned.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the link is less transparent even though a name mismatch can be normal for a monorepo sub-package.

Repo toolingcaution

The project uses established build tools, but no security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Workflow auditcaution

All 11 workflows were analyzed, all 48 action references were pinned, and there were no untrusted checkouts or script injections. The high-confidence use-trusted-publishing finding and three workflows with top-level write permissions warrant caution, though no high- or medium-severity findings were reported.