eslint-compat-utils

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the registry artifact less independently verifiable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer base is not supported by visible organizational backing.

Release historycaution

The package has 20 releases over about three years, but none in the last 17 months. Recent repository activity partly offsets the stale registry cadence, but the release gap raises maintenance risk.

Repo bus factorcaution

All three recent commits came from one contributor, so maintenance depends heavily on a single person and has limited continuity.

Security policycaution

The repository has no security policy. This is a transparency gap, though the small package and otherwise documented source structure provide some compensation.