@koa/router

Build provenancecaution

No build attestation or staged publishing is reported. This is a transparency gap, although it is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation. This is not inherently unsafe, but it adds install-time behavior that deserves more scrutiny than a package with no lifecycle scripts.

Repo bus factorcaution

One contributor made 100% of the four commits in the last 3 months. Organization backing reduces the impact because maintenance can be handed off, but no second recent contributor is shown.

Repo commit activitycaution

There were 4 commits in the last 3 months, but only 1 active maintainer. Work is happening, though the recent maintenance capacity is narrow.

Repo toolingcaution

The repository uses TypeScript, tsup, and npm scripts, showing a defined build process. No security-scanning tools were detected, which is a modest tooling gap.