watchpack-chokidar2

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable, though this is a transparency gap rather than evidence of abandonment.

Package file treecaution

The published artifact contains only index.js and package.json, which limits transparency for consumers, although the repository contains source, tests, documentation, and type files.

Release historycaution

The package has had no release in over five years, with zero releases in the last 12 months. Active repository work partly offsets the age, but the specific release is stale.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating uncertainty about package-to-repository correspondence. The mismatch may reflect a subpackage, but the missing mention remains a caution.

Workflow auditcaution

All workflows were analyzed and all action references are pinned, with no untrusted checkout or script-injection findings. However, three workflows have top-level write permissions and high-confidence bot-conditions and github-app findings, so workflow hygiene is a caution.