to-vfile

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency, though this is a supply-chain hygiene gap rather than evidence of an unhealthy project by itself.

Release historycaution

The package has 23 releases over about 11 years, but none in the last 12 months and its latest release was about three years ago, which raises maintenance concerns.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months; together with the old latest release, this indicates limited current maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tool was detected; this is a modest transparency gap alongside otherwise clear project structure.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings and no top-level write permissions. However, all four referenced actions are unpinned, leaving avoidable build-integrity exposure; the pull_request_target trigger has no untrusted checkout or script-injection sink.