conf

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, so consumers have limited evidence connecting the published artifact to its source build.

Lifecycle scriptscaution

The package runs a prepare script during installation or package preparation, adding some install-time execution exposure even though this alone is not evidence of unsafe behavior.

Project backingcaution

The repository is owned by a user account rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all 11 recent commits, leaving the project dependent on a single active maintainer and increasing continuity risk.

Repo toolingcaution

The project uses TypeScript, webpack, and npm scripts, but no security scanning tools were detected, leaving a modest tooling gap.