temporal-polyfill

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's otherwise strong maintenance evidence.

Maintainerscaution

The registry lists one publishing account, which is a modest publishing bus factor; the organization-backed repository and active contributor set provide some compensation.

Repo bus factorcaution

One contributor made 252 of 256 recent commits, creating substantial concentration risk; the organization-owned repository and four additional active contributors provide limited compensation.

Repo toolingcaution

The repository uses npm build scripts but reports no security-scanning tools, leaving security hygiene less robust than its maintenance activity.

Security policycaution

The repository has no security policy, so vulnerability-reporting and response expectations are not documented.