package-directory

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot verify how this release was produced.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. The recent release partly offsets this for a mature, small package, but current development activity is limited.

Repo toolingcaution

No build tool or security-scanning tool was detected. This is a modest transparency gap, though the package is small and the workflow audit found no concrete issues.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence audit findings. However, both action references are unpinned, leaving workflow dependencies less reproducible.