acorn

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This reduces publication transparency, although the long release history and active linked repository provide compensating project evidence.

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation. This is an additional install-time behavior to inspect, though the signal alone does not show that it is unsafe or unusually complex.

Repo bus factorcaution

One contributor made 82% of the 17 recent commits, although 3 other contributors were active. The organization-owned project backing partly offsets this concentration, but succession risk remains.

Repo toolingcaution

The repository uses Rollup, npm scripts, and Babel for builds, showing an established build process. No security-scanning tools were detected, which is a modest transparency and maintenance gap.

Security policycaution

The linked repository has no security policy. This makes vulnerability reporting and response expectations less explicit, though active maintenance and repository activity provide some compensation.