ra-data-local-storage

Build provenancecaution

No build attestation or trusted-publisher evidence was collected for the release. This limits publication transparency, but it is not by itself evidence of poor maintenance.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention ra-data-local-storage. A monorepo mismatch is ordinary, but the lack of a package mention leaves some uncertainty that this repository is the intended source.

Security policycaution

The linked repository has no published security policy. That is a transparency gap for reporting vulnerabilities, although CodeQL scanning and active maintenance provide some compensation.

Workflow auditcaution

All 29 analyzed action references are unpinned, and the audit found high-confidence unsound-contains findings in the test workflow plus a top-level write permission in one workflow. Low-confidence cache-poisoning findings are hygiene concerns only, but the overall workflow setup warrants caution.