vfile-message

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency, though this is a supply-chain transparency gap rather than evidence that the release is unsafe.

Dangerous workflowscaution

One workflow uses pull_request_target, which requires careful handling of untrusted contributions; however, no untrusted checkout or script-injection pattern was detected, limiting the concern.

Release historycaution

The package is mature, with 22 releases over roughly 9 years, but it has had no release in the last 12 months despite the latest release being established and stable.

Repo commit activitycaution

The repository had zero commits and zero active maintainers during the last three months, indicating recently stalled development and increasing abandonment risk.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest security-hygiene gap.