pdfkit

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, so consumers cannot independently verify how the registry artifact was produced.

Repo toolingcaution

The project uses established build and test tools, including Rollup and Vitest. No security scanning tools were detected, leaving a minor process gap.

Security policycaution

No repository security policy was found, which reduces transparency about vulnerability reporting and handling.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Both action references are unpinned, a reproducibility and action-supply-chain hygiene gap.