pg-pool

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, limiting publication transparency even though this is not evidence of unsafe code.

Maintainerscaution

Only one registry account has publish access, which concentrates release authority, though repository activity provides evidence of a wider maintenance community.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry publisher represents a genuine concentration of release authority; the wider contributor activity partly offsets it.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting guidance less transparent despite its use of Dependabot.

Type declarationscaution

No type declarations are included, which is a minor integration gap for TypeScript consumers but does not indicate abandonment or poor maintenance.