@feathersjs/adapter-commons

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, leaving publication provenance less transparent despite the package's active release history.

Lifecycle scriptscaution

A prepublish script is present, adding some install and publication complexity, but this signal alone does not show unsafe behavior.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository alignment; the organization and namespace match provide partial context but do not remove the gap.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tools are reported; the missing scanning is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving reporting and vulnerability-response expectations undocumented.