glob

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence was found, leaving publication provenance less independently verifiable despite the otherwise strong project evidence.

Lifecycle scriptscaution

A prepare install-time lifecycle script is present, which adds some installation complexity and supply-chain exposure compared with a package without lifecycle scripts.

Project backingcaution

The repository is owned by the individual user isaacs rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 6 recent commits came from one contributor, giving the project a concentrated bus factor and increasing continuity risk if that maintainer becomes unavailable.

Repo commit activitycaution

The repository received 6 commits in the last 3 months from one active maintainer, demonstrating recent activity but limited maintenance breadth.