@xmldom/is-dom-node

Name lookalikedanger

The package borrows the identity of the much more established @xmldom/xmldom: borrows_lookalike_identity is true, with about 11.8 million versus 176.9 million monthly downloads and 2 versus 43 stable releases. Despite zero artifact overlap, this is strong evidence that consumers could choose the wrong package.

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving the artifact-to-source release path less transparent.

Lifecycle scriptscaution

A prepare script runs during installation, adding build or execution behavior that consumers should account for, although this signal alone does not show harmful behavior.

Maintainerscaution

Only one registry account has publish access, creating a narrow publishing base. The organization-backed repository provides some context, but does not remove the single-publisher concentration.

Release historycaution

The package has only two releases, both published on October 9, 2023, and none in the last 12 months. That is a substantial maintenance and freshness concern for a package now over two years old.