mupdf

mupdf 1.28.1 appears to be a mature, stable release with a clear AGPL-3.0-or-later license, bundled TypeScript declarations, no runtime dependencies, and a sustained release history since January 2023. It is not deprecated and uses a stable major version, while the prepack script is consistent with producing a WebAssembly distribution. However, no source repository is declared, so repository maintenance, contributor activity, issue handling, and build transparency cannot be verified; the artifact also lacks packaged tests and a changelog, and has no build provenance attestation. The package is usable, but adopting it carries moderate transparency and verification risk.

Latest 1.28.1NPM

Health Score Breakdown

Build provenancecaution

No build attestation, trusted publisher identity, staged publishing, or approver is recorded. For a compiled WebAssembly artifact this limits verifiability of how the published binaries were produced.

Maintainerscaution

Only one registry account, artifex-js, has publish access. This does not establish actual maintenance activity, but it does indicate a narrow publication control base and limited redundancy if that account becomes inactive.

Package scaffoldingcaution

The artifact includes a substantive README, but no packaged tests or changelog are present. Because this is a compact WebAssembly distribution, the missing tests and changelog are a hygiene gap, though not evidence of abandonment by themselves.

View all 11 health checks

Maintainers

artifex-js