atomically

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the published artifact was produced.

Repo bus factorcaution

All 3 recent commits came from one contributor, so maintenance depends heavily on a single person and could be vulnerable to interruption.

Repo toolingcaution

The repository uses TypeScript and esbuild, but no security scanning tools were detected; this is a modest transparency gap rather than a severe concern.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.