resolve-pkg

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less verifiable even though this is not evidence of a bad release.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, which weakens current maintenance evidence despite the recent release and repository push.

Repo toolingcaution

The repository uses a build tool but reports no security-scanning tools, leaving a modest tooling gap for a small package.

Workflow auditcaution

The complete audit found no injection or high-severity findings, but both analyzed action references are unpinned, reducing workflow reproducibility and supply-chain hygiene.