treeverse

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, limiting transparency about how the published artifact was produced.

Release historycaution

The package has made seven releases since July 2019, but none in nearly four years; that long release gap is meaningful evidence of slowing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of current maintenance capacity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; its Dependabot, CodeQL, and npm-audit tooling provides some compensation.

Workflow auditcaution

All 37 analyzed action references are unpinned, and the audit found one high-confidence script-injection issue plus high-confidence ad hoc package installs. No untrusted checkout or dangerous trigger was reported, so this is workflow hygiene risk rather than a severe standalone dependency verdict.