typedarray.prototype.slice

Build provenancecaution

The release uses staged publishing, but no build attestation is present. This limits verifiable provenance without outweighing the repository and maintenance evidence.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts. These are a modest supply-chain and reproducibility concern because installation or publication behavior is not entirely represented by ordinary runtime files.

Repo bus factorcaution

One contributor made all two commits in the last three months. The organization-owned repository provides some handoff capacity, but current activity remains concentrated.

Workflow auditcaution

All six workflows were analyzed with no audit findings, no untrusted checkouts, and no script injections. However, all six action references are unpinned and one workflow grants top-level write access, creating a moderate workflow-hygiene concern.