p-queue

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, so consumers cannot verify how the published artifact was produced. This is a transparency gap, partially offset by the coherent source repository and release history.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected. This is a modest transparency and hygiene gap rather than a direct dependency risk.

Workflow auditcaution

The sole workflow was fully analyzed with no detected injection or high-severity findings, but both action references are unpinned. That leaves avoidable workflow supply-chain exposure.