jsdoc

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have limited evidence connecting the published artifact to its source build.

Licensecaution

The package declares Apache-2.0 and includes a license file, but artifact detection also found MIT text not covered by the declaration, creating a licensing mismatch.

Release historycaution

The package has a long history with 53 releases and a 43-day median interval, but only one release in the last 12 months indicates a slower current cadence.

Repo bus factorcaution

One contributor made all recent commits, leaving maintenance dependent on a single person; organizational ownership helps provide some handoff capacity but no second active contributor is shown.

Repo commit activitycaution

The repository recorded five commits in the last three months, but activity is modest and concentrated in one active maintainer.