sequelize

Build provenancecaution

No build attestation or staged publishing is provided, leaving publication provenance less transparent. This is a modest supply-chain transparency gap, not evidence that the release is unsafe on its own.

Lifecycle scriptscaution

A prepare script runs during installation, which adds execution-time supply-chain exposure compared with a package that has no install lifecycle behavior. No other provided signal shows that this script is unsafe.

Release historycaution

The package has a long history and 632 releases, but only one release in the last 12 months despite a roughly two-day median interval historically. Recent repository activity and exact-version release notes partly offset the slower registry cadence.

Workflow auditcaution

All nine workflows were analyzed successfully, with no untrusted checkout or script-injection sink. However, high-confidence findings include blanket GitHub App permissions, an unpinned container image, and template-injection hygiene concerns, while three of 49 action references are unpinned.