sockjs-client

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency and supply-chain hygiene gap, not evidence that the release is unsafe.

Release historycaution

The package has 32 releases over nearly 14 years, but no release in the last 12 months and the latest release was in May 2022. This materially raises freshness and abandonment concerns for a dependency.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, indicating little recent development activity. The recent repository push and organization backing partly compensate, but do not restore a normal release cadence.

Repo toolingcaution

The repository uses build tooling including Gulp, esbuild, and npm scripts, but no security scanning tools were detected. The build setup supports maintainability while the missing scanning is a modest hygiene gap.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, no dangerous triggers, and no broad write permissions. However, all three action references are unpinned, weakening build reproducibility and update safety.