js-object-utilities

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency; the package still has a matching repository and a straightforward artifact layout.

Maintainerscaution

Only one registry account has publish access. The organization-owned repository provides some backing, so this is a caution about publishing continuity rather than a severe dependency risk.

Release historycaution

The package is about five and a half years old with six releases and one release in the last year. Releases are infrequent, roughly 16 months apart on median, which is a mild maintenance concern but not abandonment evidence given the recent release.

Repo bus factorcaution

All two recent commits came from one contributor. Organization ownership provides some handoff capacity, so the concentration is a caution rather than a severe single-person risk.

Repo commit activitycaution

The repository recorded two commits in the last three months from one active maintainer, confirming recent maintenance but showing a thin ongoing activity base.