node-catbox

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged publishing evidence. This leaves the relationship between the source repository and the published artifact less independently verifiable.

Lifecycle scriptscaution

The package defines a prepack lifecycle script. Because it runs during packaging rather than consumer installation, it is a limited concern, but it adds some build-process complexity.

Maintainerscaution

Only one registry account, depthbomb, has publish access. This is a single-publisher risk, although the linked repository shows that the same owner is actively maintaining the project.

Project backingcaution

The source repository is owned by the individual user depthbomb rather than an organization. This is consistent with the single-maintainer findings and provides no organizational succession signal.

Repo bus factorcaution

All 6 recent commits came from one contributor, giving a 100% top-contributor share. With a user-owned project rather than organization backing, this is a genuine continuity risk.