nostr-tools

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, limiting verification of how the release was produced. This lowers transparency but is not, on its own, evidence that the package is unfit.

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing, adding some build-time supply-chain surface. Only one such script is reported, so this is a hygiene concern rather than a severe risk.

Repo bus factorcaution

The top contributor made 73.5% of the last three months' commits, creating concentration risk. However, five additional contributors were active, and organization backing provides some capacity for handoff.

Repo toolingcaution

The project uses build tooling through just and TypeScript, but no security-scanning tools are reported. The build setup is positive while the missing scanning coverage is a modest hygiene gap.

Security policycaution

No security policy is present in the repository, reducing transparency about vulnerability reporting and response procedures. This is a maintenance and disclosure gap, not evidence of active insecurity.