vite-tsconfig-paths

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, leaving publication origin less independently verifiable. This is a transparency gap rather than evidence that the release is unsafe.

Repo bus factorcaution

One contributor made 24 of 28 recent commits, or about 86%, leaving meaningful continuity risk. A second contributor made 4 commits, which partly offsets the concentration but does not remove it.

Repo toolingcaution

The repository uses TypeScript, Vitest, and Vite build tooling, supporting a structured project. No security scanning tooling was observed, which is a minor hygiene gap.

Workflow auditcaution

Both workflows were analyzed cleanly, use read-only permissions, and have no flagged audit findings or untrusted checkout paths. Six of 10 action references are unpinned, a modest reproducibility and update-integrity weakness.