ml-array-min

Build provenancecaution

No build provenance attestation or trusted publisher identity was recorded for the release. Consumers therefore have less verifiable evidence connecting the published artifact to the source build.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months after the April release. For a library with a recent major release, this is a maintenance warning, though it does not by itself establish abandonment.

Repo toolingcaution

The repository uses TypeScript, Vitest, and npm scripts, showing a reproducible build and test setup, but no security scanning tools were detected. The missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found. This does not show a defect in the package, but it leaves the project’s vulnerability-reporting process undocumented.

Workflow auditcaution

All 7 analyzed action references are unpinned, which weakens build reproducibility. The audit also found high-confidence use of long-lived registry publishing credentials; no untrusted checkout or script-injection sink was detected, limiting the severity.