conventional-changelog-codemirror

Registry deprecationdanger

The entire package is deprecated, with npm advising users to use conventional-changelog-conventionalcommits or conventional-changelog-angular instead. Package-wide deprecation is a severe adoption risk regardless of the active repository.

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot verify how the artifact was produced. This weakens supply-chain transparency but is not itself proof of compromise.

Repo bus factorcaution

One contributor made about 91% of the recent commits, despite six contributors being active. Organization backing provides some continuity, but the recent work remains highly concentrated.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the package's relationship to the linked monorepo is not directly demonstrated. The monorepo structure partly explains the mismatch but does not remove the transparency gap.

Repo toolingcaution

The repository uses build tooling, but no security-scanning tools were detected. This is a modest transparency gap rather than evidence of unsafe behavior.