jsonrepair

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between source and published artifact less independently verifiable.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or package preparation, adding execution during the install path; the available signals do not show what the script does.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer activity represents a genuine continuity risk rather than normal organizational delegation.

Repo bus factorcaution

Three contributors were active, but the top contributor made 7 of 9 commits, or about 78%, leaving maintenance materially concentrated.

Repo toolingcaution

The project uses TypeScript, Babel, npm scripts, and Rollup for builds, but no security scanning tools were detected, leaving a security-process gap.