vfile-reporter

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this artifact was produced. This is a supply-chain transparency gap, though not evidence of maliciousness.

Release historycaution

The package has existed for about 11 years with 29 releases, but its latest release was about 2 years ago and there were no releases in the last 12 months. This points to slowing maintenance rather than immediate abandonment.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, indicating that development activity has currently stalled. The non-archived repository and recent release history partly offset, but do not remove, this concern.

Repo toolingcaution

The repository uses TypeScript, esbuild, and npm scripts, showing an established build process, but no security-scanning tools were detected. The missing scanning is a modest transparency and hygiene gap.

Workflow auditcaution

Both workflows were analyzed completely with no audit findings or unsafe checkout/script-injection sinks, and the pull_request_target trigger is not dangerous on its own. However, all four action references are unpinned, weakening build reproducibility.