toml

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers receive less verifiable evidence about how the artifact was published.

Repo bus factorcaution

All 14 recent commits came from one contributor, leaving maintenance capacity highly concentrated and increasing continuity risk.

Repo toolingcaution

The repository uses npm scripts for builds but reports no security scanning tools, leaving a security-process gap despite active development.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned; the missing top-level permissions block is not concerning on its own.