mailgun.js

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication and build origin less verifiable despite the active project.

Licensecaution

The package declares MIT, but the linked repository license file is detected as Apache-2.0. The release is licensed, but the mismatch creates avoidable legal ambiguity.

Repo bus factorcaution

One contributor made all 16 recent commits, creating a meaningful continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository recorded 16 commits in the last 3 months, so activity has not vanished, but the recent activity is concentrated in one active maintainer.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response procedures unclear.