traverse

Build provenancecaution

No build attestation or trusted publisher is recorded, which limits release provenance transparency, though staged publishing and a named approver provide some compensating control.

Dependency profilecaution

Five runtime dependencies are a moderate dependency surface for a small library, adding some maintenance exposure without indicating an excessive or unusual profile.

Lifecycle scriptscaution

The package has prepack and prepublish scripts, which increase publishing complexity, but these are packaging-time scripts rather than evidence of an install-time runtime requirement.

Maintainerscaution

Only one registry account has publish access, but registry access does not measure actual maintenance capacity; repository activity provides the stronger evidence here.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational handoff capacity.