turndown

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, so consumers have limited cryptographic evidence about how the published artifact was produced.

Lifecycle scriptscaution

A prepare script runs during installation or packaging, adding build-related supply-chain surface; the repository's analyzed workflow showed no dangerous checkout, injection, or pull-request-target patterns to offset that concern.

Repo commit activitycaution

No commits or active maintainers were recorded during the last three months, which is a meaningful maintenance concern; recent releases and merged pull requests provide only partial compensation.

Repo toolingcaution

The repository uses npm scripts, Rollup, and Babel for builds, but no security-scanning tooling was detected, leaving a modest transparency and preventative-maintenance gap.

Token permissionscaution

The only workflow lacks a top-level permissions declaration, so its GitHub token permissions are not explicitly minimized even though no write permissions were detected.