pako

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing transparency about how the published artifact was produced.

Maintainerscaution

Only one registry account has publish access, which is a publishing concentration concern, though the repository is backed by an organization and has multiple active contributors.

Repo bus factorcaution

One contributor made about 91% of the 70 recent commits, creating concentration risk; the other five contributors remain active, and organizational backing provides some ability to hand off maintenance.

Repo toolingcaution

The repository uses TypeScript, npm scripts, Rollup, and Vite for builds, showing established build tooling, but it reports no security-scanning tools.