vfile-matter

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less independently verifiable.

Release historycaution

The package has 12 releases since 2019, but none in the last 12 months and its latest release was about 18 months ago, indicating slower maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful maintenance warning even though the repository is not archived.

Repo toolingcaution

TypeScript and npm build tooling are present, but no repository security-scanning tool is reported.

Workflow auditcaution

Both workflows were analyzed without high-confidence findings or untrusted checkouts, but all four action references are unpinned, weakening build reproducibility.