tiny-lru

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how the artifact was produced.

Lifecycle scriptscaution

A prepare script runs during installation, adding build-time behavior that consumers should account for, although this is not by itself evidence of poor maintenance.

Repo bus factorcaution

All five recent commits came from one contributor, leaving limited resilience if that maintainer becomes unavailable.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers, sinks, or findings, and it scopes permissions at job level. However, all 3 action references are unpinned, leaving a reproducibility and action-integrity hygiene gap.