vfile-statistics

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, but it is not evidence that the release is unsafe by itself.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase workflow risk when handling untrusted pull requests. No untrusted checkout or script-injection patterns were detected, partly limiting the concern.

Release historycaution

The package has existed since 2016 with nine releases, but it has had no release in about 3 years and no releases in the last 12 months, indicating reduced maintenance activity.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, consistent with the roughly 3-year release gap and increasing abandonment risk.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, supporting reproducible project structure, but it has no detected security-scanning tools, which reduces security-process transparency.