microdiff

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, reducing release traceability despite the package having a clear source repository and matching contents.

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing, adding some build-process complexity, but this is not an install-time script and is limited supply-chain exposure.

Maintainerscaution

Only one registry account has publish access. That is a concentration risk, although repository activity confirms the same maintainer is actively publishing and maintaining the project.

Repo bus factorcaution

One contributor made all four commits in the last three months, creating a high bus-factor risk; the repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset it.

Repo toolingcaution

The project uses TypeScript and npm build scripts, but no security scanning tools were detected, leaving a modest security-process gap.