conf

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving the relationship between source and published artifact less independently verifiable.

Lifecycle scriptscaution

A prepare script runs during installation or packaging, adding a small execution-surface concern even though the signal does not show harmful behavior.

Maintainerscaution

One registry account has publish access, which concentrates publishing authority; repository activity shows the same individual is currently maintaining the project.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor and publisher base has no visible organizational handoff support.

Repo bus factorcaution

All one recent commit came from a single contributor, concentrating current maintenance responsibility and increasing continuity risk.