@msgpack/msgpack

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the link between source and published artifact less transparent than it could be.

Lifecycle scriptscaution

The package uses a prepare install lifecycle script, which adds execution during installation and warrants some caution despite the absence of runtime dependencies.

Release historycaution

The package is mature, with 72 releases since 2019 and a release as recent as December 2025, but only one release occurred in the last 12 months, indicating a slower current cadence.

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk; organization ownership provides some ability to hand maintenance off but does not show a second active contributor.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing thin recent maintenance activity despite the recent release.