graphology

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable; this is a transparency gap rather than evidence of harm.

Lifecycle scriptscaution

A prepare script runs during installation, which adds build-time execution surface; the signal gives no evidence that the script is harmful, so this is a limited caution.

Release historycaution

The package has 66 releases and historically released about every 14 days, but there has been no registry release in about 20 months. Recent repository commits partly offset the stale published cadence, but do not remove the release risk.

Repo toolingcaution

The project uses npm scripts, Rollup, TypeScript, and Babel for builds, but has no detected security-scanning tools, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response procedures.