@sindresorhus/is

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication origin less verifiable than it could be; the long release history partly offsets this gap.

Lifecycle scriptscaution

A prepare install-time script is present, adding build or installation behavior that consumers should account for, but this signal alone does not show unsafe behavior.

Project backingcaution

The repository is owned by a user rather than an organization, so the single active contributor and single registry maintainer represent a genuine concentration of maintenance responsibility.

Repo bus factorcaution

One contributor made 100% of the single recent commit, leaving maintenance dependent on one active person rather than a broader contributor base.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, so current development activity is light despite the recent push and continuing release history.