unist-util-visit-parents

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, so consumers have less evidence connecting the published artifact to its source build.

Repo commit activitycaution

The repository recorded no commits or active maintainers in the last three months, a maintenance concern partly offset by the recent release and push.

Workflow auditcaution

Both workflows were analyzed with no audit findings and no untrusted checkout or script-injection sinks. However, all four action references are unpinned, leaving a reproducibility and action-supply-chain hygiene gap.