jest-worker

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving the connection between source and published artifact less transparent. The repository and package structure provide some context but do not replace provenance.

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it runs with elevated trust context, but no untrusted checkout or script-injection patterns were detected across the analyzed workflows.

Repo bus factorcaution

Three contributors were active recently, but one contributor made about 96% of the commits. The organization-owned repository provides some handoff capacity, yet the current work remains highly concentrated.

Repo package mentioncaution

The repository name does not match jest-worker and its README does not mention the package, which creates some uncertainty about package ownership. The Jest organization and the package's clear Jest-specific README context provide partial compensation, but the linkage is still less explicit.

Repo toolingcaution

The repository uses established build tools and has a build system, but no security scanning tools were detected. This is a transparency and process gap, not evidence that the package is unsafe.