get-east-asian-width

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency, although the package contents and linked repository are otherwise consistent.

Maintainerscaution

A single registry publishing account is a modest concentration risk, but it corresponds to the individual repository owner and is not contradicted by the repository's recent release and pull-request activity.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the single-maintainer concentration; however, the owner directly matches the package repository.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last 3 months, which is a maintenance concern, although three pull requests were merged in the last month and version 1.7.0 was just released.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, supporting reproducible project structure, but it reports no security-scanning tools, leaving a modest security-hygiene gap.