@alcalzone/ansi-tokenize

Build provenancecaution

No build attestation is present, so consumers cannot independently verify how the published artifact was produced. A trusted publisher identity of GitHub is useful context but does not replace provenance.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation, adding some supply-chain and install-time complexity. The repository's explicit build and test tooling provides context, but does not remove the extra execution surface.

Project backingcaution

The package is backed by a matching repository owned by an individual account, not an organization. The direct project match is positive, while individual ownership leaves less formal maintenance redundancy.

Repo bus factorcaution

All two recent commits came from one contributor, giving the project a narrow short-term maintenance base. This is a real continuity risk because the repository owner is an individual rather than an organization.

Repo commit activitycaution

The repository had two commits in the last three months, so activity is present but limited in volume.