xml-crypto

Build provenancecaution

No registry attestation or trusted-publisher provenance is present, so consumers receive less evidence about how the artifact was built; the active, matching repository provides partial context but not verifiable provenance.

Lifecycle scriptscaution

The package runs a prepare script during installation or publishing. This is a modest supply-chain consideration, but the available project structure shows a conventional TypeScript build rather than an unexplained install workflow.

Repo bus factorcaution

Six contributors were active, but one contributor made about 87% of recent commits, creating meaningful continuity risk; organization backing partly compensates for that concentration.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent than ideal.

Workflow auditcaution

Both workflows were fully audited with no injection, untrusted-checkout, or high-confidence findings, and permissions are scoped or read-only. However, all 9 analyzed action references are unpinned, which weakens build reproducibility and action supply-chain protection.