jsonwebtoken

Build provenancecaution

No build attestation or trusted-publisher provenance is available for this release, leaving publication origin less independently verifiable.

Dependency profilecaution

The package has 10 runtime dependencies, including several small lodash utilities and JWT-related components. This is a meaningful dependency surface but not inherently excessive for the package's function.

Release historycaution

The package has existed for about 13 years with 82 releases, but only one release in the last 12 months. Its long history is reassuring, while the recent cadence warrants caution.

Repo bus factorcaution

All recent commit activity came from one contributor, creating a narrow short-term maintenance base. Organization ownership provides some ability to hand maintenance off, but no second recent contributor is shown.

Repo commit activitycaution

Only one commit from one active maintainer was recorded over the last three months. That is a significant sign of currently slow maintenance, despite the repository remaining active.