chrome-remote-interface

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing release transparency even though this alone does not indicate an unsafe package.

Lifecycle scriptscaution

A prepare script runs during installation, which adds execution surface; the signal does not show that it performs unsafe or unusual work.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing base; the linked repository confirms an individual owner rather than organizational backing.

Project backingcaution

The source repository is owned by an individual account, so there is no organization backing shown to compensate for the single registry maintainer.

Release historycaution

The project is mature, with 79 releases since 2013, but only one release in the last 12 months; the long median interval is less concerning because a current release exists.