p-queue

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving publication origin less independently verifiable despite the otherwise matching source repository.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor maintenance concentration is not offset by visible organizational backing.

Repo bus factorcaution

All six recent commits came from one contributor, giving the project a concentrated maintenance dependency and increasing continuity risk.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both of its two action references are unpinned, which weakens build reproducibility.