viget/viget-primary-term

Release historycaution

This is the package's first release, published 0 days ago, so there is no release track record yet. That limits evidence of durability but is partly expected for a genuinely new package.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a modest transparency gap, not a standalone supply-chain failure.

Workflow auditcaution

All 9 of 9 action references are unpinned, which weakens build reproducibility. The low-confidence cache-poisoning finding carries hygiene weight at most, while the workflows have no untrusted checkout or script-injection paths and no broad top-level write permissions.