js-toml

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, which reduces publication transparency, though it is a supply-chain transparency gap rather than evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer and bus-factor concerns are not buffered by visible organizational backing.

Repo bus factorcaution

All 47 recent commits came from one contributor, creating a meaningful continuity risk if that maintainer becomes unavailable; the active commit rate partly compensates but does not remove the concentration.

Repo toolingcaution

The repository uses TypeScript, Vitest, tsup, and npm scripts, demonstrating a real build and test toolchain, but no security scanning tools were detected.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations less transparent than they could be.