@feathersjs/authentication-oauth

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported. That reduces publication transparency, although it is a supply-chain hygiene gap rather than evidence of abandonment.

Dependency profilecaution

The release has 11 runtime dependencies, including several Feathers components and OAuth/session libraries. This is a meaningful dependency surface but not excessive for an OAuth integration package.

Lifecycle scriptscaution

A prepublish lifecycle script is present, which adds some install and publication complexity, but the available package and repository structure provides no evidence that it is unsafe or unusually disruptive.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package. Although a monorepo can legitimately contain subpackages, this makes package-to-repository ownership less transparent.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but reports no security scanning tools. Build support is present while automated security coverage is limited.