sm-crypto

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present. This reduces release transparency, though it is not by itself evidence that the package is unsafe.

Maintainerscaution

Only one registry account has publish access, which creates publishing concentration. The active source repository provides some compensating maintenance evidence, but not a second publisher.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no organizational handoff signal to offset the concentrated contributor activity.

Repo bus factorcaution

Recent work is concentrated: one contributor made 11 of 12 commits, or about 92%, while the second made one. The active second contributor helps, but the project remains dependent on one primary maintainer.

Repo toolingcaution

The project uses webpack, Babel, and npm scripts, showing an established build process. It has no reported security-scanning tools, leaving a modest hygiene gap.