node-oauth1

Build provenancecaution

The release has no build attestation, trusted publisher, or staged publishing record. This limits release transparency, but it is a provenance gap rather than evidence that the package is unfit.

Maintainerscaution

Only one registry account has publish access, which limits publishing redundancy. However, the repository is owned by an organization, so the short registry list is not by itself evidence of weak project backing.

Release historycaution

The latest release was in May 2020, with no releases in the last 12 months; this is a meaningful maintenance concern for a dependency, even though the package has a long release history and 11 published versions.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This indicates currently quiet maintenance, although the recent push and organizational ownership provide some counterweight.

Repo issue activitycaution

There are 31 open pull requests and no issues or pull requests were merged in the last month. The backlog and lack of recent resolution suggest limited maintenance responsiveness.