superjson

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving publication origin less verifiable. This is a transparency caution, balanced by the package's long release history and linked source repository.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected. The missing scanning is a modest hygiene gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, reducing the project's published guidance for reporting vulnerabilities. This is a transparency gap, not a standalone dependency blocker.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted checkouts, but all 3 action references are unpinned. Unpinned actions weaken build reproducibility and supply-chain hygiene.