leaflet

Build provenancecaution

No build attestation or trusted publisher identity is reported, leaving the artifact's build origin less independently verifiable.

Lifecycle scriptscaution

A prepare script runs during installation or package preparation. This is a modest supply-chain and installation-complexity concern, though the package has no runtime dependencies and has visible build tooling.

Release historycaution

The package has 51 releases over more than 13 years, but no registry release in the last 12 months. Active repository work partly offsets the slower release cadence.

Workflow auditcaution

The single workflow was fully analyzed and uses read-only permissions, with no untrusted checkout or script injection. However, all 17 action references are unpinned, and the audit reports a high-confidence trusted-publishing concern, so workflow hygiene lowers confidence in the release process.