limiter

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged-publishing evidence, so consumers have less assurance connecting the artifact to its source build.

Maintainerscaution

Only one registry account has publish access, which creates a bus-factor concern for publication continuity, although registry access records do not determine actual development activity and the repository shows active maintenance.

Project backingcaution

The repository is owned by an individual user rather than an organization, so institutional backing is limited; this is partly offset by the repository's recent activity and long release history.

Repo toolingcaution

The repository uses TypeScript and Babel build tooling, but no security scanning tools were detected; this is a modest transparency and hygiene gap rather than a standalone severe risk.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance undocumented and creating a minor transparency gap.