js-message

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is present, leaving release origin less independently verifiable despite the package's otherwise transparent source repository.

Maintainerscaution

Only one registry account has publish access, which creates release-continuity risk, although repository activity shows another active contributor.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer and concentrated contributor activity provide less organizational continuity.

Repo bus factorcaution

Two contributors were active in the last 3 months; the leading contributor made 5 of 7 commits, so activity is concentrated but not dependent on one contributor.

Security policycaution

No repository security policy was found, reducing clarity about vulnerability reporting and response expectations.