libnpmpack

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match libnpmpack and its README does not mention the package, creating uncertainty about the package-to-source association even though a monorepo mismatch can be ordinary.

Type declarationscaution

The package is a JavaScript library with no type declarations, which creates a real integration and editor-support gap for typed consumers.

Workflow auditcaution

All 133 analyzed action references are unpinned, weakening workflow reproducibility; high-confidence template-injection findings add hygiene concerns, while no untrusted checkout or script-injection sink was found.