nyc

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less evidence connecting the published artifact to its source build.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Although a recent release and push provide some compensating evidence, current maintenance activity is weak.

Repo issue activitycaution

There were no new or closed issues and no new or merged pull requests in the last month, while 188 issues remain open. This suggests limited current project responsiveness.

Repo toolingcaution

The repository uses npm build tooling, but no security scanning tools were detected. That is a modest transparency and maintenance gap rather than evidence of a severe problem.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or audit findings. However, all 5 action references are unpinned, which leaves workflow dependencies exposed to unexpected upstream changes.