@marcbachmann/cel-js

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the registry artifact was produced.

Project backingcaution

The repository is owned by the individual user marcbachmann rather than an organization, so the concentrated recent contributor activity is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all recent commits, giving the project a concentrated maintenance base and increasing dependence on a single person.

Repo commit activitycaution

Only one commit was recorded in the last three months, so repository development has slowed despite the strong registry release history.

Repo toolingcaution

No build tool or security-scanning tool was detected. This is a transparency and maintenance hygiene gap, though it is moderated by the package's active release history.