mux-embed

Build provenancecaution

The package has no build attestation and does not use staged publishing, so consumers have limited verifiable evidence connecting the artifact to its build. The trusted publisher ID is GitHub, which provides some context but does not replace an attestation.

Maintainerscaution

Three of four publishing accounts use the mux.com domain, indicating clear organizational ownership, but dylanjha publishes through a Gmail account. That is an account-hygiene caution, not evidence of a thin maintenance team.