merge-anything

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Maintainerscaution

Only one registry account has publish access, creating some publishing continuity risk, though the linked repository shows that account is actively maintaining the project.

Repo bus factorcaution

All 19 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited observable redundancy.

Repo issue activitycaution

There are six open issues and three open pull requests, with no issues or pull requests closed in the last month; this is a modest responsiveness concern, although commits and releases remain active.

Repo toolingcaution

TypeScript and npm build tooling are used, but no security-scanning tools are configured, leaving a transparency and detection gap.