mapbox-gl

Build provenancecaution

No build attestation or staged publishing was detected, so consumers have less direct evidence connecting the published artifact to its source build.

Repo package mentioncaution

The repository name does not exactly match mapbox-gl and its README does not contain the exact package name, creating a small linkage-transparency concern even though the README clearly describes Mapbox GL JS.

Repo toolingcaution

The project uses established build and test tooling, including TypeScript, Rollup, Vitest, esbuild, and Vite, but no security-scanning tool was detected, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were fully audited with no findings or untrusted checkouts, and job-level permissions are used; however, all seven action references are unpinned, weakening workflow reproducibility and tamper resistance.