tesseract.js-core

Build provenancecaution

No registry build attestation or trusted-publisher provenance is present, leaving the relationship between the published WebAssembly artifact and its source build less transparent.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months. This is a meaningful maintenance warning, though the recent release and recent repository push partly offset the abandonment concern.

Repo issue activitycaution

There is only one open issue and five open pull requests, but no issues or pull requests were merged in the last month, consistent with currently limited development activity.

Repo toolingcaution

The repository reports no build tool and no security-scanning tool. The missing security automation is a hygiene gap, while the project does provide build scripts and a documented build process.

Workflow auditcaution

The single workflow was fully analyzed with no detected injection or high-severity findings. However, both action references are unpinned, which weakens build reproducibility and action supply-chain control.