speed-measure-webpack-plugin

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving publication origin less transparent. This lowers supply-chain transparency but does not by itself indicate an unsafe release.

Lifecycle scriptscaution

The package runs a prepare script during installation, adding an install-time execution surface. No provided signal shows that this script is unsafe, so this is a limited hygiene concern.

Maintainerscaution

Only one registry account has publish access. The repository is user-owned rather than organization-backed, so there is little visible publishing redundancy.

Project backingcaution

The repository is owned by a single user account, not an organization, which provides less visible backing for continuity if that maintainer becomes unavailable.

Release historycaution

The project is mature, with 35 releases over more than eight years, but only one release in the last 12 months indicates a currently slow cadence.