on-change

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, limiting publication transparency, although the release is tied to a matching active repository and release notes.

Project backingcaution

The repository is owned by a named individual rather than an organization, so the single registry maintainer does not indicate organizational backing; this leaves a somewhat thin continuity model.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, a maintenance caution, though the package had a release and repository push during that period.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected; this is a minor transparency gap rather than evidence of abandonment.

Workflow auditcaution

All workflows were analyzed successfully and no audit findings or dangerous untrusted triggers were reported. However, both action references are unpinned, leaving a minor reproducibility and action-integrity gap.