uc.micro

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving release provenance less transparent than stronger publishing setups.

Maintainerscaution

Only one registry account has publish access, which creates publishing concentration; the organization-owned repository provides some compensating project backing.

Repo bus factorcaution

One contributor made all 11 recent commits, creating a meaningful continuity risk; organization ownership partly offsets the risk by allowing maintenance handoff.

Repo toolingcaution

The project uses Rollup, TypeScript, and npm scripts, but no security scanning tools are reported, leaving a modest security-hygiene gap.

Workflow auditcaution

The workflow was fully analyzed, has read-only permissions, no untrusted triggers or injection findings, and no audit findings; however, both referenced actions are unpinned, which is a minor reproducibility and supply-chain hygiene gap.