libnpmaccess

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less independently verifiable even though other maintenance evidence is strong.

Repo package mentioncaution

The linked repository name does not match libnpmaccess and its README does not mention the package, creating uncertainty about the linkage despite the organization-owned npm monorepo context.

Type declarationscaution

No type declarations are published, which reduces ergonomics for TypeScript consumers of this library, though it does not indicate abandonment or unsafe maintenance.

Workflow auditcaution

All 133 analyzed action references are unpinned, and four workflows grant top-level write permissions; the pull_request_target workflow had no untrusted checkout or script-injection sink, so this is workflow hygiene caution rather than a severe finding.