jssha

Build provenancecaution

The release has no attestation, trusted publisher, or staged-publishing record, leaving the artifact-to-source build path less transparent despite the healthy source project.

Lifecycle scriptscaution

A prepare script runs during installation, which adds some install-time behavior and deserves awareness, but this signal alone does not show harmful or unnecessary activity.

Maintainerscaution

Only one registry account has publish access, creating publishing continuity risk, although repository activity shows that the project is still being maintained.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor and single registry publisher base provide limited demonstrated maintenance redundancy.

Repo bus factorcaution

Two contributors were active recently, but the top contributor made 14 of 15 commits, so maintenance depends heavily on one person.