js-tiktoken

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving the relationship between source and published artifact less transparent.

Maintainerscaution

Only one account has registry publish access. That is a thin publishing base and increases continuity and release-process risk, although repository evidence shows an established project.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no organizational backing signal to offset the thin maintainer base.

Release historycaution

The package is mature, with 22 releases since May 2023, but it has had no releases in the last 12 months; that materially weakens evidence of ongoing maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the repository was pushed with the latest release in August 2025, the recent activity gap is a meaningful maintenance concern.