bcryptjs

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, leaving the relationship between source and published artifact less independently verifiable.

Maintainerscaution

Only one registry account has publish access, creating a continuity and release-capacity concern. The long release history and linked repository provide some compensation, but do not remove the single-publisher risk.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no demonstrated organizational backing to compensate for the single-maintainer publishing model.

Repo commit activitycaution

There were no commits and no active maintainers recorded during the last three months. The recent repository push and current release partly offset this, but the immediate maintenance signal is weak.

Repo toolingcaution

The project uses npm scripts and TypeScript, but no security scanning tools were detected. This is a meaningful security-hygiene gap, though it is not evidence that the package is malicious.