node-plop

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less independently verifiable.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, a meaningful maintenance concern despite the recent push and registry releases.

Repo toolingcaution

TypeScript and Turbo provide build tooling, but no security scanning tools were detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, so there is no documented channel or process for reporting vulnerabilities.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous sinks or audit findings, but both action references are unpinned, weakening reproducibility and update integrity.