memoize

Build provenancecaution

No build attestation or staged publishing is provided, leaving publication provenance less verifiable. This is a transparency weakness but not evidence that the release is unfit.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. This is a meaningful maintenance concern, though the recent release and repository push provide some counterevidence.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. The missing scanning reduces maintenance and supply-chain hygiene.

Workflow auditcaution

The workflow audit completed fully with no reported findings, no untrusted checkout, and no script injection. However, both referenced actions are unpinned, which creates a modest reproducibility and action-integrity concern.