@globalart/nestcord

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between source and published artifact less independently verifiable.

Lifecycle scriptscaution

A prepare install-time script can add installation complexity and execution exposure, so it is a modest supply-chain hygiene concern.

Maintainerscaution

One registry maintainer indicates concentrated publishing access, but the repository is owned by an organization, which provides some continuity beyond the registry account.

Repo bus factorcaution

One contributor made all recent commits, creating a concentrated maintenance dependency; organizational ownership partly mitigates handoff risk but does not remove it.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating very limited recent direct development activity despite the recent release and pull-request throughput.