telecom-mas-agent

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency for this release. This is a meaningful weakness alongside the package's minimal repository.

Licensecaution

The manifest declares MIT, but the repository license file was detected as GPL-3.0 and no license file is included in the package. This mismatch creates genuine licensing and transparency risk.

Maintainerscaution

One registry maintainer is consistent with the repository being user-owned, but it leaves the package dependent on a single publisher and provides little redundancy if that person stops maintaining it.

Package file treecaution

The published artifact contains only README.md, index.js, and package.json, while the repository contains just three files as well. That unusually small footprint provides little evidence of a mature, maintained implementation.

Project backingcaution

The linked repository is owned by an individual rather than an organization, so there is no visible organizational backing to offset the single-maintainer risk.