memfs-or-file-map-to-github-branch

Build provenancecaution

No build attestation or trusted-publisher information is present, reducing release transparency. This is a provenance gap rather than evidence that the package is unsafe.

Lifecycle scriptscaution

The package declares a `prepublish` lifecycle script, adding publishing-time behavior that should be understood before relying on the release process. No further script details are provided to show whether it creates meaningful risk.

Maintainerscaution

Only one registry account, `orta`, can publish releases. The linked repository is also owned by that user, so this is a real bus-factor concern rather than evidence of organization-backed maintenance.

Project backingcaution

The repository is owned by an individual account rather than an organization. Combined with the single publisher, this provides limited visible project backing.

Release historycaution

The package has 13 releases since 2018, but none in the last 12 months; its latest release was about 18 months ago. This indicates slowed maintenance, though the package is not abandoned outright.