@pm2/js-api

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, but this is a transparency gap rather than a health verdict by itself.

Lifecycle scriptscaution

A prepare script runs during installation, adding some install-time behavior that consumers should understand, though this signal alone does not indicate severe risk.

Release historycaution

The package is mature, with 59 releases over more than eight years and a release in the last year, but only one release in the last 12 months indicates a slower cadence.

Repo bus factorcaution

All recent repository commits came from one contributor, creating concentrated maintenance risk; organization backing provides some ability to hand off ownership but does not show a second active contributor.

Repo commit activitycaution

Only one commit was made in the last three months by one active maintainer, showing limited recent maintenance capacity despite the recent release.