osc-progress

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable.

Lifecycle scriptscaution

The package uses prepack and prepare scripts. These are common build-time scripts, but they add installation and publication behavior that should be reviewed before adopting the dependency.

Maintainerscaution

Only one registry account has publish access, which creates publishing continuity risk, although repository activity provides evidence of ongoing maintenance.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor and single publisher signals represent genuine continuity risk.

Repo bus factorcaution

One contributor made 29 of 30 recent commits, so maintenance is highly concentrated; the second active contributor provides only limited compensation.