ml-array-max

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers have less independently verifiable evidence connecting the artifact to its source.

Repo commit activitycaution

No commits or active maintainers were recorded in the last 3 months. The recent release partly offsets this, but the absence of ongoing activity is a maintenance concern.

Repo toolingcaution

The repository uses TypeScript, Vitest, and npm scripts, but no security scanning tools were detected, leaving security hygiene less visible.

Security policycaution

No security policy was found in the repository, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All 7 workflow action references are unpinned, which weakens reproducibility. The audit found no untrusted checkout or script-injection path; its informational trusted-publishing finding is not a severe workflow risk.