nest-winston

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable; this is a transparency gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. This is a resilience concern for publishing continuity, though it is administrative evidence and does not outweigh the observed repository activity.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational maintenance cushion to offset the concentrated contributor activity.

Release historycaution

The package has existed for about 8 years with 43 releases, but only one release arrived in the last 12 months; this suggests slower maintenance without indicating abandonment by itself.

Repo bus factorcaution

One contributor made all five commits in the last three months, creating a genuine single-person continuity risk; the repository's current activity partly offsets abandonment concerns but not the concentration itself.