@codemirror/legacy-modes

Build provenancecaution

No build attestation or trusted publisher is recorded, leaving the origin of the published artifact less verifiable and compounding the transparency gap.

Lifecycle scriptscaution

An install-time prepare script adds execution during installation, which increases build complexity and warrants more transparency than a script-free package.

Maintainerscaution

Only one registry account has publish access, creating a modest continuity and release-control concern; this administrative signal does not establish actual project activity by itself.