chroma-js

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency weakness, not evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow project backing structure.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Recent releases and issue merges soften this, but the missing direct development activity remains a meaningful maintenance concern.

Repo toolingcaution

The repository uses Rollup, Vitest, npm scripts, and Babel, showing a defined build and test toolchain. No security scanning tools are reported, which is a modest hygiene gap.

Security policycaution

No security policy is present in the repository, reducing transparency about vulnerability reporting and response expectations.