decode-named-character-reference

Build provenancecaution

No build attestation or trusted-publisher provenance is available. The package remains usable, but consumers have less evidence connecting the published artifact to its source.

Maintainerscaution

Only one registry account has publish access. That is a concentrated publishing path, although the repository is maintained by the same individual and the release history shows continued activity.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-person maintenance model is not compensated by visible organizational backing.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release offsets this somewhat, but the lack of current source activity creates a maintenance concern.

Repo toolingcaution

The repository uses TypeScript, webpack, and npm scripts, indicating an established build process. No security scanning tooling is present, limiting automated security hygiene.