workbox-streams

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release-origin transparency weaker than it could be. This is a supply-chain hygiene gap, not evidence that the package is unsafe.

Release historycaution

This is a mature package with 73 releases over roughly eight years and a latest release on May 4, 2026. Only two releases occurred in the last 12 months, which indicates slower recent cadence but not abandonment given the recent release and active repository.

Repo package mentioncaution

The repository name does not match workbox-streams and its README does not mention the package, which is a transparency concern. However, the repository file tree clearly contains the broader Workbox monorepo and the package's source files, making the mismatch consistent with a monorepo subpackage.

Security policycaution

The repository has no SECURITY.md policy, so the process for reporting vulnerabilities is less transparent to users and contributors.