json-stable-stringify

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving publication provenance less transparent. This is a supply-chain transparency gap, but it is not evidence that the release is unsafe.

Dangerous workflowscaution

Two of six workflows use pull_request_target, which warrants review because that trigger can expose elevated repository context. However, no untrusted checkouts or script-injection patterns were detected, limiting the practical concern.

Dependency profilecaution

Five runtime dependencies add some supply-chain and upgrade surface for a small utility, though the count is not excessive and no other provided signal identifies problematic dependencies.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing backup. The repository is also owned by that same individual, so this is a real bus-factor concern rather than an organization-backed publishing setup.

Project backingcaution

The repository is backed by an individual account rather than an organization, so there is no demonstrated organizational continuity to offset the single-publisher and contributor concerns.