walk-sync

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the connection between source and published artifact less transparent. This is a supply-chain transparency gap, not evidence of compromise.

Lifecycle scriptscaution

The package uses prepack and prepare scripts, which are consistent with building its distributed files. These scripts add some install and publication complexity but are not shown to be unsafe here.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the repository was pushed for the latest release, the quiet window is a meaningful maintenance concern.

Repo issue activitycaution

The repository has only one open issue and three open pull requests, with no issues or pull requests opened or merged in the last month. This indicates limited current activity but not severe abandonment.

Repo toolingcaution

The project uses TypeScript and npm scripts for builds, but no security scanning tools were detected. The build setup is established, while security-tooling coverage is limited.