@convex-dev/auth

Licensecaution

The manifest declares Apache-2.0, while the artifact license file was detected as ISC, creating a license coverage mismatch that should be resolved before adoption.

Lifecycle scriptscaution

A prepare install lifecycle script is present. This is a modest supply-chain and installation-behavior consideration, but the signal alone does not indicate poor maintenance.

Maintainerscaution

Most publishing accounts use the convex.dev domain and the project has organization backing, although consumer accounts such as nipunn (gmail.com) and aritrakh (gmail.com), plus outside-domain accounts erquhart, mikewheaton and nicolapps, add account-hygiene risk.

Repo commit activitycaution

Only 5 commits were recorded in the last 3 months, but four maintainers were active and pull-request merges were strong, so this is a mild activity concern rather than abandonment evidence.

Repo toolingcaution

The project uses TypeScript, esbuild and tsup, but no security-scanning tools were detected, leaving a modest review gap.