html-webpack-plugin

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers receive less verifiable evidence about how this release was published.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation, adding some build-time execution surface, though this is not by itself evidence of poor maintenance or unsafe behavior.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the small active contributor base does not have clear organizational handoff support.

Repo bus factorcaution

Two contributors were active in the last 3 months, although the top contributor made two of three commits; the small active base is a mild continuity concern.

Repo toolingcaution

The project uses TypeScript, webpack, and npm scripts, but no security-scanning tools were detected, leaving a security-process gap.