got

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This reduces release transparency, though the active repository and long release history provide compensating maintenance evidence.

Lifecycle scriptscaution

The package defines a prepare install-time lifecycle script. This adds build or installation behavior that should be understood, but the signal alone does not show harmful or excessive behavior.

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated contributor activity is not visibly offset by organizational backing. The active release and commit history still show current ownership.

Repo bus factorcaution

One contributor made 25 of 27 recent commits, or about 93%, leaving maintenance highly concentrated. The project is active, but this concentration creates continuity risk.

Repo toolingcaution

The repository uses TypeScript and npm build tooling but reports no security-scanning tools. This is a minor transparency and hygiene gap, partly offset by the repository's security policy and active maintenance.