koffi

Fast and easy-to-use dynamic C FFI (foreign function interface) for Node.js

Latest 3.3.3

NPM

72%

Total Score

caution

Frequent releases and a current repository are offset by one-contributor maintenance and limited security transparency.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present, leaving published artifacts less independently verifiable despite the package's active release history.

Lifecycle scripts

An install lifecycle script is expected for a native module but still increases installation complexity and the amount of code executed during dependency installation.

Maintainers

Only one registry account has publish access, which is a concentration risk, though the repository evidence confirms that the same owner is actively maintaining the project.

Project backing

The repository is owned by an individual user rather than an organization, so the single-contributor and single-publisher concentration signals are not offset by visible organizational backing.

Repo bus factor

All recent commits came from one contributor with a 100% share, leaving maintenance dependent on a single individual.