p-limit

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, which limits publication transparency, although this is not evidence of an unsafe release by itself.

Maintainerscaution

One registry publisher account is consistent with this user-owned project, but publishing concentration leaves less registry-side redundancy than a broader maintainer group.

Repo toolingcaution

No build tool or security scanning tool was detected, which modestly limits automated assurance, but the package has a small, transparent repository and a separate security policy.

Workflow auditcaution

The single workflow was fully analyzed with no failed files, untrusted checkouts, injection findings, or high-severity issues. Both of its two action references are unpinned, a minor reproducibility and update-integrity gap.