json-schema-resolver

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency, although the package is a small source-distributed JavaScript library with a visible repository.

Maintainerscaution

Only one registry account has publish access. The matching personal repository and recent push provide some continuity, but the narrow publishing base leaves little redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer concern is not offset by visible organizational backing.

Release historycaution

The package has existed since 2020 with 10 releases, but none in the last 12 months; the latest release was about 20 months ago, indicating a quiet release cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful sign of currently limited maintenance capacity.