isurl

Build provenancecaution

No build attestation or trusted-publisher provenance is available, limiting verification of how the artifact was produced.

Maintainerscaution

Only one registry account has publish access, leaving publishing continuity dependent on a single person; the linked repository is also user-owned rather than organization-backed.

Repo bus factorcaution

One contributor made all recent commits, creating a meaningful continuity risk without organizational backing.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity despite the recent release.

Repo toolingcaution

The project uses TypeScript, Rollup, and npm scripts, but no security-scanning tooling was detected.