@xhmikosr/bin-check

Build provenancecaution

No build attestation or trusted-publisher identity is present. This weakens release transparency, although it is not by itself evidence that the package is unsafe.

Maintainerscaution

Only one registry account has publish access. The linked repository is also user-owned rather than organization-owned, so there is no project-backing evidence to offset the concentrated publishing responsibility.

Project backingcaution

The repository owner is a user, not an organization, so the signals provide no organizational succession or handoff capacity to compensate for concentrated maintenance.

Repo bus factorcaution

One contributor made all two recent commits, giving the project a complete short-term contributor concentration and no demonstrated backup maintainer.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and disclosure expectations unspecified. This is a transparency gap rather than a severe dependency risk.