@jridgewell/gen-mapping

Build provenancecaution

No build attestation or trusted-publisher provenance was found. This is a supply-chain transparency gap, though it is partly offset by the visible source repository and reproducible-looking package contents.

Release historycaution

The package has 23 releases over about 4 years, but only one release in the last 12 months, indicating a currently slower release cadence.

Repo bus factorcaution

All three-month commit activity came from one contributor, creating a concentrated maintenance base; the repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset it.

Repo commit activitycaution

The repository had one commit in the last three months from one active maintainer. This shows activity but is thin enough to lower confidence in sustained maintenance.

Repo toolingcaution

The project uses TypeScript, Turbo, npm scripts, and esbuild, but no security scanning tools were detected. The build setup is mature, while the missing scanning is a modest transparency gap.