@webassemblyjs/helper-fsm

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less evidence connecting the published artifact to its source build.

Licensecaution

A license file is present, but the manifest declares ISC while the artifact and repository license are detected as MIT; the mismatch reduces licensing transparency.

Maintainerscaution

The registry lists one publishing account, but the repository is maintained under the same individual owner; this is a thin base and leaves limited visible redundancy.

Project backingcaution

The package is linked to a user-owned repository rather than organization backing, so the single registry maintainer provides little organizational redundancy.

Release historycaution

The package has 72 releases since 2018, but none in the last 12 months and its latest release was about 22 months ago, indicating stalled release activity.