nuxt-auth-utils

Build provenancecaution

No build attestation or trusted publisher identity is recorded, leaving publication provenance less transparent than it could be, though this is not evidence of a defective release.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the two-person contributor base provides useful but limited continuity backing.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tools were detected, leaving a modest maintenance and review gap for authentication software.

Security policycaution

The repository has no SECURITY.md or other detected security policy, which makes vulnerability-reporting expectations less clear for a security-focused package.

Workflow auditcaution

Both workflows use read-only permissions and have no untrusted checkouts or script injection, but two of seven action references are unpinned and high-confidence adhoc-package findings plus use-trusted-publishing reduce workflow reproducibility and supply-chain hygiene.