tldjs

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency. This is a provenance gap rather than evidence that the release is unsafe.

Lifecycle scriptscaution

Install-time scripts include postinstall, prepack, and prepublish. These add build and installation complexity, though the package documentation describes an update-rules installation flow that makes lifecycle use plausible.

Maintainerscaution

Only one registry account has publish access. That is a limited publishing base, although the linked repository and release history show an established project.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing to offset the single-publisher and contributor-base concerns.

Release historycaution

The package has 35 releases over more than 14 years, but no releases in the last 12 months; this indicates a mature project with currently slow release activity.