jsesc

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits release transparency, although the package is small and its source repository is linked and matched.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no demonstrated organizational succession or backing. This modestly increases single-owner continuity risk.

Release historycaution

The package has 23 releases since July 2013, but none in the last 12 months and its latest release was about 21 months ago. This suggests maintenance has slowed, though the long release history indicates substantial maturity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the extended gap since the latest release. This raises abandonment risk for future fixes.

Repo toolingcaution

The repository uses Grunt and npm scripts for builds, but has no security-scanning tools. The missing scanning is a modest hygiene gap, not evidence that the package is unsafe to depend on.