node-sql-parser

Build provenancecaution

No build attestation or trusted publisher is recorded, so consumers have less independently verifiable evidence connecting the artifact to its source build.

Maintainerscaution

Only one registry account has publish access. Because the repository owner is an individual rather than an organization, this represents a real continuity risk despite the project's long history.

Release historycaution

The project is mature, with 180 releases since 2016, but only 2 releases in the last 12 months compared with a historical median interval of about 5 days. That indicates a meaningful slowdown in release activity.

Repo bus factorcaution

One contributor made 100% of the 2 commits in the last 3 months. With individual project backing, this concentrated activity leaves maintenance dependent on one person.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, all from one active maintainer. That is sparse recent maintenance for a mature parser project.