jwt-decode

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving the relationship between the published artifact and its source less transparent. The matching repository and reproducible-looking package layout provide some context but do not replace provenance.

Release historycaution

The package has 29 releases over roughly 12.6 years, but no releases in the last 12 months and its latest release was in October 2023, indicating materially reduced release activity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This weakens evidence of ongoing maintenance despite the repository not being archived.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, and all six action references are pinned. However, high-confidence findings identify an unpinned container image and a potentially spoofable bot condition.