re2js

Build provenancecaution

The release has no build attestation or staged publishing evidence, leaving publication provenance less transparent despite the package's active release history.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor maintenance concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 41 recent commits came from one contributor, concentrating maintenance capacity and increasing abandonment or handoff risk.

Repo toolingcaution

The project uses build and test tooling, but no security scanning tools were detected, leaving security-oriented maintenance less visible.

Workflow auditcaution

Both workflows scope permissions at the job level, and no untrusted checkout or script-injection paths were found. However, all 13 action references are unpinned; the reported cache-poisoning findings are low-confidence hygiene warnings rather than established vulnerabilities.