node-stream-zip

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less independently verifiable. This is a transparency gap rather than evidence that the package is unsafe.

Maintainerscaution

Only one account has registry publish access. This is a continuity concern, although repository activity shows that the account is currently maintaining the project.

Project backingcaution

The repository is owned by an individual rather than an organization. This provides no organizational maintenance buffer and reinforces the continuity concern from concentrated contribution activity.

Repo bus factorcaution

All 8 recent commits came from one contributor, concentrating maintenance and review capacity in a single person. The repository owner is an individual, so no organizational handoff evidence offsets this concentration.

Repo issue activitycaution

Four issues were opened in the last month and none were closed, while two pull requests were opened and none merged. This indicates incoming activity without demonstrated recent resolution.