@xhmikosr/downloader

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This limits publication transparency, although it is not by itself evidence of an unhealthy project.

Dependency profilecaution

Seven runtime dependencies create a meaningful dependency surface for a downloader library. The profile is not unusually large, but each dependency adds some maintenance exposure.

Maintainerscaution

Only one registry account has publish access. That is consistent with the individually owned repository, but it leaves little publishing redundancy.

Project backingcaution

The package and repository are owned by the same individual account, so the source ownership is coherent. There is no organization backing to provide additional maintenance capacity.

Repo bus factorcaution

All 7 recent commits came from one contributor, so maintenance depends on a single active developer. The repository is user-owned, with no organizational backing shown to offset that concentration.