js-base64

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how the registry artifact was produced; the package's otherwise transparent repository and simple dependency profile partly reduce the concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent commit share represents a genuine bus-factor consideration.

Repo bus factorcaution

Four contributors were active, but the leading contributor made about 82% of recent commits, leaving maintenance somewhat concentrated.

Repo toolingcaution

The project uses build tooling including TypeScript, Rollup, Make, and npm scripts, but no security-scanning tools were detected; this is a minor hygiene limitation rather than a severe health concern.

Workflow auditcaution

Both workflows were analyzed without high- or medium-confidence findings, and permissions are not broadly writable; however, all five action references are unpinned, leaving avoidable maintenance and supply-chain hygiene risk.