better-path-resolve

Build provenancecaution

No build attestation or trusted-publisher configuration is present, reducing publication transparency; this is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. That is a limited publishing base, although repository activity provides some additional evidence of ongoing ownership.

Release historycaution

The package has only two releases across roughly seven and a half years, with one release in the last 12 months. The recent release shows current activity, but the long interval indicates a mature, very slow-moving project.

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single active developer.

Repo commit activitycaution

The repository recorded two commits in the last three months, so it is active but only lightly maintained.