string-ts

Build provenancecaution

No build attestation, trusted publisher, or staged publishing was detected, so consumers cannot independently verify how this release was produced.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance warning despite recent repository push metadata and ongoing releases.

Repo toolingcaution

The project uses a modern TypeScript build and test toolchain, but no security-scanning tooling was detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no published security policy, so the process for reporting and handling vulnerabilities is unclear.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers or high-severity findings, but all 10 action references are unpinned and the audit found repeated high-confidence ad hoc package installs, weakening build reproducibility.