mupdf

Build provenancecaution

No build attestation, trusted publisher identity, staged publishing, or approver is recorded. For a compiled WebAssembly artifact this limits verifiability of how the published binaries were produced.

Maintainerscaution

Only one registry account, artifex-js, has publish access. This does not establish actual maintenance activity, but it does indicate a narrow publication control base and limited redundancy if that account becomes inactive.

Package scaffoldingcaution

The artifact includes a substantive README, but no packaged tests or changelog are present. Because this is a compact WebAssembly distribution, the missing tests and changelog are a hygiene gap, though not evidence of abandonment by themselves.