media-engine

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. The release therefore offers limited evidence connecting the published artifact to its source build.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or preparation, adding build-time behavior that consumers should understand. It is a modest transparency concern, not a severe risk by itself.

Project backingcaution

The repository is owned by an individual rather than an organization, so maintenance capacity depends on a personal project owner. Recent activity from two contributors partly compensates for that limited backing.

Repo toolingcaution

The project uses TypeScript and npm-based build tooling, supporting a reproducible source layout, but it has no security scanning tools. The missing scanning is a minor hygiene gap.

Security policycaution

The repository has no security policy. This weakens disclosure and maintenance transparency, although it does not by itself show abandonment or unsafe code.