mammoth

Build provenancecaution

No build attestation or trusted-publisher provenance is available, reducing publication transparency despite the package's otherwise established release history.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or packaging, adding execution during dependency setup; no further evidence shows that it is unsafe.

Repo bus factorcaution

All 33 recent commits came from one contributor, so maintenance depends heavily on a single individual; the repository owner is an individual rather than an organization.

Repo toolingcaution

The project uses build tooling, but no security scanning tools were detected, leaving a modest gap in visible security hygiene.

Security policycaution

No repository security policy was found, making vulnerability reporting and response expectations less transparent.