@videojs/http-streaming

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This weakens publication transparency, though it is not evidence that the package is unsafe by itself.

Licensecaution

The artifact includes a license file and declares Apache-2.0, so the release is licensed. The detected text also includes BSD-2-Clause, creating a license-coverage mismatch that warrants checking.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. That is a concrete recent-maintenance gap, although the recent release and push history provide some counterevidence.

Repo issue activitycaution

There were no new or closed issues in the last month and no merged pull requests, with 190 issues still open. Combined with zero recent commits, this suggests limited current maintenance activity.

Repo toolingcaution

The project uses npm scripts, Rollup, and Babel, showing an established build process. It has no detected security-scanning tools, leaving a modest assurance gap.