side-channel

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded. This limits publication transparency, but it is a provenance gap rather than evidence that the package is unhealthy.

Dependency profilecaution

Five runtime dependencies, including alternative side-channel implementations, create some transitive maintenance exposure for a small utility package. The profile is not excessive enough to indicate a serious health problem.

Lifecycle scriptscaution

The package has prepack and prepublish scripts. These are build-time publication hooks rather than install-time execution, so they add limited review surface but are not a major adoption concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer does not benefit from visible organizational backing. Other repository evidence shows the project is nevertheless directly maintained by that owner.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release and push partly compensate, but the lack of recent development activity is a maintenance caution.