nitropack

Build provenancecaution

No build attestation or trusted-publisher identity was provided, leaving release provenance less transparent; this is a moderate supply-chain hygiene gap rather than evidence of abandonment.

Dependency profilecaution

The package has 70 runtime dependencies, a substantial dependency surface for a server framework, but the available evidence does not show that this profile is unmanaged or unusually risky.

Repo package mentioncaution

The repository name does not match nitropack and its README does not mention the package, creating a transparency concern even though a monorepo can legitimately contain sub-packages.

Workflow auditcaution

All four workflows were analyzed, use read-only permissions, and pin all 23 action references. The audit found low-confidence cache-poisoning hygiene and several high-confidence ad-hoc package installs, but no untrusted checkout or script-injection path.