own-keys

Build provenancecaution

The release has no attestation or trusted-publisher identity, although staged publishing and an approver are present. This reduces publication transparency without indicating abandonment.

Lifecycle scriptscaution

The package defines prepack and prepublish lifecycle scripts. These are build and publication hooks rather than ordinary install hooks, so they are only a modest supply-chain consideration.

Maintainerscaution

Only one account has registry publish access. That is a limited publishing base, although repository activity shows the same maintainer is currently active.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer and single-contributor concentration is not compensated by visible organizational backing.

Repo bus factorcaution

One contributor made all five commits in the last three months, concentrating maintenance in a single person and increasing continuity risk.