express-openapi-validator

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving the connection between source and published artifact less verifiable.

Dependency profilecaution

Fourteen runtime dependencies create a meaningful maintenance and transitive-risk surface for this library, although the profile is consistent with an Express/OpenAPI validator and includes established type and validation components.

Maintainerscaution

Only one registry account has publish access. The linked repository is user-owned rather than organization-owned, so the narrow publishing base provides limited redundancy.

Project backingcaution

The repository is owned by the individual user cdimascio, so there is no organization backing shown to provide maintenance handoff or contributor redundancy.

Release historycaution

The package has existed for about 7 years with 313 releases and a latest release on January 20, 2026, but only two releases in the last 12 months indicate substantially slower recent delivery than its historical cadence.