robust-predicates

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how the published artifact was produced. The clean, small package structure partly reduces the practical concern but does not remove the gap.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer and contributor activity has no visible organizational handoff support.

Repo bus factorcaution

All one recent commit came from a single contributor, leaving maintenance concentrated in one person and increasing continuity risk.

Repo commit activitycaution

The repository had one commit in the last 3 months from one active maintainer. This is limited activity, but it is consistent with a mature package and is partly supported by the recent release.

Repo toolingcaution

The repository uses Rollup and npm scripts for builds, showing a defined build process, though no security scanning tooling was detected.