node-forge

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving the correspondence between source and published artifact less verifiable.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some publishing-process complexity and supply-chain exposure. The signal does not show an install-time script, so this is a caution rather than a severe dependency risk.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a significant sign that day-to-day maintenance may have slowed. The recent registry release and repository push provide some compensating evidence but do not remove the concern.

Repo issue activitycaution

The repository has 403 open issues and 61 open pull requests, while no issues were closed or pull requests merged in the last month. This backlog suggests limited responsiveness despite some incoming activity.

Repo toolingcaution

The repository uses build tooling, but no security scanning tools were detected. For a cryptography library, the absence of visible automated security scanning is a meaningful maintenance and transparency gap.