@xhmikosr/decompress

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving release origin less verifiable; this is a transparency gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access, creating publishing continuity risk, although repository activity shows that the same maintainer is actively maintaining the project.

Project backingcaution

The package and repository are owned by the same individual rather than an organization, so the single-maintainer concentration is a genuine continuity concern.

Repo bus factorcaution

One contributor made all 12 commits in the last three months, so maintenance depends heavily on a single person and could be vulnerable to interruption.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less transparent.