structured-headers

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged-publishing evidence, limiting verification of how the published artifact was produced.

Lifecycle scriptscaution

A prepare install lifecycle script is present, which adds build-time execution and supply-chain complexity compared with a package without install scripts.

Maintainerscaution

Only one registry account has publish access. This is a resilience concern, although the linked repository and release activity show an identifiable active owner rather than an abandoned package.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and single-contributor risks are not offset by visible organizational backing.

Repo bus factorcaution

All four recent commits came from a single contributor with a 100% share, creating a genuine continuity and handoff risk for a user-owned project.