@webassemblyjs/leb128

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account, xtuc, has publish access. This is a thin publishing base and modestly increases continuity risk, although registry access does not prove that only one person maintains the source.

Project backingcaution

The repository is owned by the user account xtuc rather than an organization, so the single registry maintainer is not explained by organization-backed publishing.

Release historycaution

The package has 72 releases since April 2018, but none in the last 12 months; its latest release was in November 2024, indicating a prolonged maintenance slowdown.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The January 2025 push and non-archived status provide limited compensation, but recent maintenance capacity remains weak.