sync-child-process

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less independently verifiable. This is a transparency gap rather than evidence that the release is unsafe.

Release historycaution

The package has only three releases, all concentrated within about four days, with no release in nearly two years. Recent repository activity partly offsets the stale registry cadence but does not provide a newer package version.

Security policycaution

The repository has no published security policy, leaving no clear documented path for reporting vulnerabilities.

Workflow auditcaution

The audit covered both workflows and found no untrusted checkout or script injection, but all 10 action references are unpinned and the release workflow installs a package outside a lockfile. The audit also identified trusted publishing usage; these are workflow hygiene and provenance concerns, not standalone evidence of maliciousness.