monaco-editor

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication reproducibility less transparent. The package's long release history and active repository provide partial compensating evidence.

Repo bus factorcaution

All recent commits came from one contributor, creating short-term concentration risk. Microsoft organizational backing provides some capacity to hand maintenance off, but no second active contributor is shown in this period.

Repo commit activitycaution

Only seven commits were recorded in the last three months, indicating limited recent repository activity compared with the package's strong release cadence.

Version stabilitycaution

Version 0.57.0 is not a prerelease, but 90% of recent versions are prereleases, which makes the broader versioning pattern less predictable despite this release being stable.

Workflow auditcaution

All workflows were analyzed, all 10 action references are pinned, and there are no untrusted checkouts or script injections. Both workflows install packages outside a lockfile, a minor high-confidence hygiene concern.