jest-watcher

Build provenancecaution

No build attestation or trusted-publisher identity was recorded, leaving release origin less independently verifiable; the repository's active maintenance and workflow audit provide partial context but not equivalent provenance.

Repo bus factorcaution

One contributor made about 96% of the recent commits, creating a real concentration risk; organization ownership and two additional active contributors partly compensate.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the linkage is less explicit; organization ownership and the package's monorepo-style artifact structure partly reduce that concern.

Workflow auditcaution

All 11 workflows were analyzed with no unpinned actions, untrusted checkouts, or script injection, but three workflows grant top-level write access and the audit reports trusted publishing with a long-lived registry token.