humanize-duration

Build provenancecaution

The release has no attestation, trusted publisher identity, or staged-publishing provenance, leaving publication origin less transparent. This is a supply-chain hygiene gap rather than evidence that the package is unsafe.

Maintainerscaution

Only one registry account has publish access, which is a concentration concern, but the linked user-owned repository shows three active contributors recently and ongoing releases, providing some compensating maintenance evidence.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational succession benefit to offset the concentrated contributor and registry-publisher base.

Repo bus factorcaution

The top contributor made 87.5% of recent commits, creating meaningful concentration risk despite two additional contributors remaining active.

Repo toolingcaution

The repository uses a build tool, but no security-scanning tools are detected. The missing scanning is a hygiene gap, while the presence of build tooling supports maintainability.