mocha-multi-reporters

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. This reduces release transparency and makes artifact provenance harder to verify, though it is not evidence that the release is malicious.

Maintainerscaution

Two registry accounts have publish access. This is a modest publishing base, but registry access alone does not establish active maintenance and is outweighed here by the repository activity evidence.

Project backingcaution

The repository is owned by an individual user rather than an organization. Individual ownership is not inherently unhealthy, but it provides less visible institutional backing and increases reliance on a small maintainer base.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. Although a release and repository push occurred recently, the lack of observed commit activity is a meaningful maintenance-continuity concern.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. This is a transparency and process gap, although the package is small and has a straightforward source layout.