unique-stream

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing transparency about how this release was produced. This is a supply-chain hygiene gap, not evidence that the release is malicious.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance. The recent registry release and recent repository push provide some compensating evidence but do not show sustained development.

Security policycaution

The repository has no security policy, which leaves vulnerability-reporting expectations undocumented. Dependabot scanning provides some compensating security maintenance evidence.

Workflow auditcaution

The single workflow was fully audited and has read-only permissions with no dangerous triggers or findings. However, both of its two action references are unpinned, leaving them exposed to moving dependencies.