msgpackr-extract

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, reducing release transparency even though this does not establish a defect.

Lifecycle scriptscaution

An install script is present, consistent with a native addon that may need to fetch or build platform binaries, but it adds installation complexity and execution-time supply-chain exposure.

Maintainerscaution

Only one registry account can publish releases. The linked repository is owned by the same individual, so this is a genuine bus-factor limitation rather than merely an organizational publishing-list gap.

Project backingcaution

The source repository is owned by an individual rather than an organization, so there is no organizational backing to offset the single-maintainer limitation.

Release historycaution

The package is mature, with 48 releases over about six years, but only one release appeared in the last 12 months, indicating a slower recent cadence.