tarn

Build provenancecaution

No build attestation or trusted-publishing evidence was collected, leaving release origin less transparent, though this is a transparency gap rather than evidence of compromise.

Repo bus factorcaution

All three commits in the last three months came from one contributor, creating a meaningful concentration risk. Organization backing partly compensates because maintenance can be handed off within the project.

Repo toolingcaution

TypeScript, Vitest, and npm build tooling are present, but no security scanning tools were detected, leaving security hygiene less visible.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts or script injection, but both action references are unpinned and it has a high-confidence adhoc-packages finding. The missing top-level permissions block is acceptable on its own.