core-js

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving the relationship between the published artifact and its source less independently verifiable.

Lifecycle scriptscaution

The package has a postinstall script, which increases installation-time supply-chain exposure compared with a package without lifecycle execution. The signal does not show that the script is malicious, but it remains a dependency-review concern.

Maintainerscaution

Only one account has registry publishing access. That is a meaningful publishing-continuity concern because there is no registry-level backup, although the repository shows five active contributors recently.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor and single-publisher structure is not compensated by visible organizational backing.

Repo bus factorcaution

The top contributor made about 94% of recent commits, creating a substantial continuity risk. Four other contributors were active, but each contributed only a small share and does not materially remove concentration.