optional-require

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving the relationship between source and published artifact less transparent.

Maintainerscaution

Only one registry account has publish access. That is a continuity concern, although repository activity shows the same maintainer is still actively publishing and contributing.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all four commits in the last three months, so maintenance depends entirely on a single individual and has limited handoff resilience.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts for its build and tests, but no security-scanning tooling was detected. The build tooling is a positive; the missing scanning is a minor hygiene gap.