konva

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, so publication provenance is less transparent even though the package otherwise has strong release and repository evidence.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout or script-injection paths, but all nine action references are unpinned and one archived action was detected. The cache-poisoning finding has low confidence, so it is hygiene rather than a severe risk.