http-proxy-middleware

Lifecycle scriptscaution

The package uses prepack and prepare scripts, which add install and publication complexity, but the available repository and provenance evidence provide context for a maintained build process.

Maintainerscaution

Only one registry account has publish access, creating some publishing continuity risk, although repository activity and build provenance show the account is actively maintaining and releasing the project.

Repo bus factorcaution

One contributor made about 96% of the 23 recent commits, which creates a genuine continuity risk; a second contributor remains active, but the project is user-owned rather than organization-backed.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Other security tooling is present, but it does not replace a published policy.

Token permissionscaution

One workflow, publish.yml, lacks top-level token permissions, while no workflow declares top-level write access and another has read-only permissions; this is a modest workflow-hardening gap rather than a severe risk.