es-abstract

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the relationship between source and published artifact less independently verifiable.

Dependency profilecaution

The package declares 54 runtime dependencies, which increases dependency surface and maintenance exposure, although its broad ECMAScript compatibility scope makes a substantial helper dependency set understandable.

Repo bus factorcaution

One contributor made all recent commits, creating maintenance concentration and limited redundancy; the repository is user-owned, so no organizational handoff evidence compensates for it.

Repo commit activitycaution

Only 3 commits were made in the last 3 months by one active maintainer; this is ongoing activity, but the recent pace is modest and concentrated.

Workflow auditcaution

All 8 workflows were analyzed with no audit findings, and 7 use read-only permissions. However, all 13 analyzed action references are unpinned, which weakens reproducibility and update integrity without indicating an active workflow exploit.