html-element-map

Build provenancecaution

Staged publishing is enabled, but no build attestation is present. This leaves publication origin less independently verifiable than an attested release.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts, which are common for preparing published artifacts but add install and publication behavior that should be understood by adopters.

Repo bus factorcaution

All five recent commits came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned, so no organizational handoff evidence compensates for that concentration.

Type declarationscaution

The package has no type declarations, which reduces convenience for typed consumers of this JavaScript library but does not indicate abandonment or a supply-chain transparency problem.

Workflow auditcaution

All six workflows were analyzed with no audit findings, and five use read-only permissions. However, all six action references are unpinned and one workflow has top-level write permissions, creating a moderate workflow-hygiene concern without an observed untrusted sink.