@joshwooding/vite-plugin-react-docgen-typescript

Build provenancecaution

The release has no build provenance attestation, so consumers have less verifiable evidence connecting the published artifact to its source build.

Maintainerscaution

Only one registry account has publish access. That is a meaningful publishing bus-factor concern for a user-owned project, though repository activity shows the same maintainer is currently active.

Repo bus factorcaution

All 3 recent commits came from a single contributor, producing a 100% top-contributor share. With user-owned project backing and no second active contributor shown, this is a genuine continuity risk.

Repo commit activitycaution

There were 3 commits in the last 3 months from 1 active maintainer. Recent work is present but relatively light and concentrated, so maintenance continuity depends heavily on one person.

Repo toolingcaution

The repository uses a build tool, but no security-scanning tools were detected. The build setup is positive, while the missing scanning coverage is a modest hygiene gap.