is-what

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent. This is a supply-chain transparency gap, not evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and single-contributor concentration is not cushioned by visible organizational backing.

Repo bus factorcaution

All 28 recent commits came from one contributor, creating a real continuity risk if that maintainer becomes unavailable. The active release history partly offsets the concern but does not remove the concentration.

Repo toolingcaution

The project uses TypeScript and npm scripts for builds, providing ordinary build structure, but no security-scanning tooling was detected. The established build setup partly compensates for that gap.

Security policycaution

The repository has no security policy, reducing clarity about how vulnerabilities should be reported and handled. This is a moderate transparency gap for a maintained package.