@jrichman/ink

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how this release was produced. This is a transparency gap, not evidence of malicious behavior.

Lifecycle scriptscaution

The package runs a prepare script during installation or preparation. This is an additional execution point that warrants care, though the signal does not show that the script is harmful.

Repo bus factorcaution

All commits in the last three months came from one contributor, leaving the project dependent on a single active maintainer. The repository is user-owned rather than organization-backed, so there is no shown handoff capacity to offset this concentration.

Repo commit activitycaution

Only one commit was made in the last three months by one active maintainer. That recent activity is materially sparse compared with the package's heavy release cadence and raises maintenance risk.

Repo toolingcaution

The repository uses TypeScript, esbuild, and npm scripts, but no security-scanning tooling was detected. The missing scanner is a modest supply-chain hygiene gap.