libsodium-wrappers

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the origin of the published artifact less independently verifiable.

Maintainerscaution

Only one registry account has publish access, which is a modest operational concentration risk, though repository activity shows a second active contributor.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted execution paths, and it scopes permissions at job level. Its one action reference is unpinned, a limited reproducibility and action-integrity weakness.