statsig-node

Build provenancecaution

No build attestation or trusted-publisher identity is present. This leaves release origin less transparent, though it is a supply-chain transparency gap rather than proof of unsafe code.

Lifecycle scriptscaution

The package runs a prepare install-time lifecycle script. This adds build or installation behavior that consumers must account for, although the signal does not show malicious or unusually risky commands.

Repo bus factorcaution

All 1 recent commit came from one contributor, giving a 100% top-contributor share. Organization ownership partly offsets the handoff risk, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, with 1 active maintainer. That recent activity is thin for a maintained SDK and raises slowing-maintenance concerns.

Repo issue activitycaution

The repository has 7 open issues and 2 open pull requests, but recorded activity shows no new or closed issues and no merged pull requests in the last month. This is a mild sign of limited current engagement.