msgpackr

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This limits publication transparency, but the active release and repository history provide compensating maintenance evidence.

Lifecycle scriptscaution

A prepare install-time script is present, so installation performs additional project-defined work beyond unpacking files. This is a modest transparency and supply-chain concern, without evidence here that the script is harmful.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational handoff signal to offset the concentrated contributor base. Active maintenance still provides meaningful support.

Repo bus factorcaution

Two contributors were active in the last three months, but the leading contributor made 80% of commits. The second contributor provides some continuity, though maintenance remains concentrated.