@zkochan/js-yaml

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is available, leaving the connection between source and published artifact less verifiable. The active, matching repository and coherent artifact provide partial context but do not remove this transparency gap.

Name lookalikecaution

The package name resembles the established `yaml` package and the README identifies that relationship, but artifact overlap is moderate rather than near-total and there is no evidence that it borrows the other package's identity or is a copy. This remains a naming and selection caution for consumers.

Repo toolingcaution

The project uses TypeScript, npm scripts, Rollup, and Vite, showing a structured build process, but no security scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of unfitness.

Version stabilitycaution

Version 0.0.11 is not a prerelease and recent releases are stable, but the 0.x major version signals a less mature compatibility commitment than a stable-major package.