winston

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's established history.

Repo commit activitycaution

Only one commit occurred in the last three months and the active maintainer count was zero, a meaningful recent maintenance slowdown despite the recent registry release history.

Repo issue activitycaution

There were no new or closed issues in the last month, while 459 issues remain open; four new pull requests without merges suggest limited recent issue throughput.

Workflow auditcaution

The sole workflow is fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, all three action references are unpinned, creating a modest reproducibility and action-substitution concern.