motion-dom

Build provenancecaution

No build attestation or trusted-publisher identity is reported, leaving publication provenance less transparent despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match motion-dom and its README does not mention the package, so the package-to-repository relationship is not clearly established; this is a transparency caution even though subpackages can belong to monorepos.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected, leaving a modest security-maintenance gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and disclosure expectations less transparent for adopters.

Workflow auditcaution

The audited workflow has no dangerous triggers or findings and scopes permissions at job level, but both of its action references are unpinned, weakening build reproducibility and action supply-chain hygiene.