es-module-lexer

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less independently verifiable despite the otherwise active project.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity and single registry publisher are not supported by organizational handoff capacity.

Repo bus factorcaution

The top contributor made about 65% of recent commits, but a second contributor made about 26% and three others contributed, making this a moderate rather than severe concentration risk.

Repo toolingcaution

The repository uses build tooling, including Babel, SWC, TypeScript, and npm scripts, but reports no security-scanning tools, leaving a modest verification gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.