filesize

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be.

Lifecycle scriptscaution

The package uses prepack and prepare lifecycle scripts, which add build-time execution surface, though the repository shows a conventional Rollup-based build.

Maintainerscaution

Only one registry account has publish access, creating publishing concentration, although repository activity shows a second active contributor.

Repo bus factorcaution

One contributor made 87.5% of the eight recent commits, but a second contributor remains active; this is a meaningful concentration risk rather than abandonment evidence.

Workflow auditcaution

The sole workflow was fully analyzed with no findings or untrusted checkouts, and it scopes permissions at job level. However, all three action references are unpinned, reducing build reproducibility.