browser-image-compression

Build provenancecaution

No build attestation or trusted-publisher identity is provided, leaving publication provenance less transparent. This is a supply-chain transparency gap, not evidence that the package is malicious.

Maintainerscaution

Only one registry account has publish access. The repository is owned by an individual rather than an organization, so there is no provided backing evidence to offset the thin publishing base.

Project backingcaution

The source repository is owned by an individual user, not an organization. This is consistent with the single registry maintainer and provides limited evidence of institutional continuity.

Release historycaution

The package has 25 releases since 2017, but its latest release was over three years ago and there were no releases in the last 12 months. This indicates substantially reduced maintenance momentum.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the long release gap, this is the strongest abandonment concern.