@javascript-obfuscator/escodegen

Name lookalikedanger

The package has complete artifact overlap with escodegen, borrows its identity, and does not describe itself as a fork, despite the README identifying the lookalike. Consumers may have intended the established escodegen package instead, making this a severe supply-chain and dependency-selection risk.

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so registry publication cannot be independently tied to a build. This is a transparency gap, although it is not by itself evidence that the release is unsafe.

Repo commit activitycaution

The linked repository recorded zero commits and zero active maintainers in the last three months, indicating no recent source maintenance. Recent package releases partly offset abandonment concerns, but they do not demonstrate ongoing repository development.

Repo issue activitycaution

There were no new or closed issues and no merged pull requests in the last month, leaving the repository's open backlog of 113 issues and 31 pull requests without evidence of active triage. This supports a maintenance concern, though the project is not archived.

Security policycaution

The linked repository has no security policy, leaving disclosure and response expectations undocumented. This lowers transparency but is less consequential than the package's identity and maintenance concerns.