nestjs-cls

Build provenancecaution

No build attestation is present, so consumers have less independently verifiable evidence connecting the published artifact to its source. The trusted publisher is identified as GitHub, which partly offsets but does not remove this gap.

Repo bus factorcaution

One contributor made about 78% of the 9 recent commits, so maintenance is concentrated despite two additional active contributors. This is a moderate continuity concern for a user-owned project.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a modest transparency gap rather than evidence of unsafe code.

Workflow auditcaution

Both workflows were analyzed cleanly with no untrusted checkout or script-injection findings, but all 4 action references are unpinned and one workflow grants top-level write access. Because no untrusted trigger reaches those permissions, this is workflow hygiene rather than a severe risk.