minimatch

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less transparent despite the otherwise well-structured package and repository.

Lifecycle scriptscaution

The package has a prepare lifecycle script, which adds install-time complexity, but the repository's explicit TypeScript build structure provides some context for why preparation may be needed.

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated maintainer and contributor activity represents a genuine single-person continuity risk.

Repo bus factorcaution

All two recent commits came from one contributor, so maintenance continuity depends heavily on a single person.

Repo commit activitycaution

Only two commits were made in the last three months by one active maintainer, indicating modest recent development activity despite the strong release history.