mdurl

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency, though the package has an established repository and release history.

Repo bus factorcaution

All seven recent commits came from one contributor, creating a meaningful continuity risk; organization backing partly compensates because maintenance can be handed off.

Repo toolingcaution

The project uses Rollup, TypeScript, and npm scripts, but no security scanning tools were detected, leaving a modest security-process gap.

Workflow auditcaution

The workflow audit completed cleanly, uses read-only permissions, and found no high-confidence findings; however, all three action references are unpinned, leaving avoidable workflow supply-chain exposure.