motion-utils

Build provenancecaution

The package has no build attestation or trusted-publisher provenance. Active releases and repository activity provide some context, but they do not replace verifiable publication provenance.

Repo package mentioncaution

The repository name does not match motion-utils and its README does not mention the package, so the package-to-repository relationship is not independently clear. The monorepo context makes this plausible, but the mismatch remains a transparency caution.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, esbuild, and npm scripts, but reports no security-scanning tools. The missing scanning is a modest transparency gap.

Security policycaution

The repository has no security policy. This does not show unsafe code, but it leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, and it scopes permissions at job level. Both action references are unpinned, which is a supply-chain hygiene caution without an exposed untrusted path.