@paralleldrive/cuid2

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported. This limits verification of how the release was produced, creating a transparency caveat.

Lifecycle scriptscaution

The package uses a prepare install lifecycle script. This adds install-time behavior and therefore some supply-chain exposure, although the signal does not show a dangerous script.

Repo bus factorcaution

All recent repository commits came from one contributor. Organizational ownership provides some handoff capacity, but no second active contributor is shown in this period, leaving a thin current bus factor.

Repo commit activitycaution

Only one commit and one active maintainer were recorded in the last 3 months, despite frequent registry releases. That mismatch suggests limited recent source activity and warrants caution about maintenance depth.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools are reported. The build setup is present, while security-process visibility is limited.