escape-string-regexp

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent; the package's simple five-file artifact and zero runtime dependencies reduce the practical impact.

Maintainerscaution

One registry publishing account is listed, which limits the visible publishing base; repository activity and backing provide some compensation, so this is not by itself a severe risk.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to compensate for the narrow maintainer base. Other evidence shows the project is established and clearly maintained enough to remain usable.

Release historycaution

The package is mature, with releases dating back to 2014, but it has had no registry release in the last 12 months and its latest release was in April 2021. This lowers confidence in ongoing release maintenance, although the package may be stable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating currently inactive development. The recent push in May 2025 and the package's narrow, stable purpose partly offset but do not remove this maintenance concern.