buffer-xor

Build provenancecaution

The release has no build attestation or trusted-publisher metadata, so consumers cannot verify how the published artifact was produced. This is a transparency gap, although it is not evidence of tampering.

Release historycaution

The package has made 7 releases since May 2015, but its latest registry release was in August 2017 and it had no releases in the last 12 months. This is a substantial maintenance concern despite the stable release history.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, providing no evidence of current development activity. This reinforces the long gap since the last registry release.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For a small JavaScript module this is not severe, but it reduces visibility into repeatable builds and security checks.