resolve

Build provenancecaution

No build attestation is present, so consumers have limited independent evidence connecting the artifact to its source. Staged publishing provides some process control but does not replace provenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful recent-maintenance concern despite the current registry release.

Workflow auditcaution

All 8 workflows were analyzed with no audit findings, and 7 use read-only permissions. However, all 12 action references are unpinned and one workflow has top-level write permissions; the pull_request_target triggers have no untrusted checkout or script-injection sink.