nano-spawn

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the connection between the published artifact and its source less independently verifiable.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow project owner base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although recent releases provide some counterevidence, this is a meaningful maintenance warning.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tooling was detected. This is a modest hygiene gap rather than evidence of abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted checkouts, but both of its two action references are unpinned. That leaves avoidable dependency-integrity risk in automation.