vitefu

Build provenancecaution

No build attestation or trusted-publisher provenance is available, which limits release transparency, but this is not by itself evidence that the package is unsafe to depend on.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, which weakens evidence of ongoing maintenance despite a recent registry release.

Repo toolingcaution

The repository uses TypeScript and Vite for builds, but no security scanning tools are present. This is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

No security policy was found in the repository, reducing clarity about vulnerability reporting and response expectations.

Workflow auditcaution

The single analyzed workflow completed without unsafe triggers, untrusted checkouts, or audit findings, but both of its 2 action references are unpinned, leaving them exposed to mutable upstream changes.