regexp-tree

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers have less independent evidence connecting the published artifact to its source.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some publication-time complexity, but no install-time script is reported and the package otherwise has clear build structure.

Maintainerscaution

Only one account has registry publish access. The matching user-owned repository provides context, but the narrow publishing base leaves limited operational redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, which is consistent with the single registry maintainer and means there is no visible organizational backing to offset that narrow base.

Release historycaution

The package has 114 releases, but none in the last 12 months and the latest release was over three years ago. This materially raises staleness risk despite its long release history.