@lydell/node-pty

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers cannot verify the release's build origin from the collected registry metadata. The active release history provides some compensating maintenance evidence, but not provenance transparency.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the concentrated contributor activity is not offset by visible organizational backing.

Repo bus factorcaution

All 4 recent commits came from one contributor, giving the project a concentrated maintenance base and increasing continuity risk if that contributor becomes unavailable.

Repo toolingcaution

The project uses npm build scripts, but no security-scanning tools were detected. The build tooling is adequate for the small project, while the missing scanning is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This lowers project transparency but is not by itself evidence of unsafe code.