ufo

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less transparent. The mature release history and matching repository provide partial context but do not replace verifiable provenance.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which raises maintenance-continuity concern. This is partly offset by the recent release history and recent repository push, but the activity gap remains material.

Repo toolingcaution

The project uses TypeScript and a build tool, but no security-scanning tool is reported, leaving a modest security-process gap.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or write-wide tokens. However, five of six actions are unpinned and both workflows install packages outside the lockfile, creating reproducibility and workflow-hygiene concerns.