ts-declaration-location

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, reducing release transparency even though this is not evidence that the package is unsafe.

Lifecycle scriptscaution

A prepare install-time script adds supply-chain and installation complexity, although it is common for packages that build or prepare artifacts.

Maintainerscaution

Only one registry account has publish access, leaving a thin publishing base; the repository is user-owned, so there is no organizational backing signal to offset that concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so long-term continuity depends on a single project owner.

Release historycaution

The package has eight releases over roughly two years, but it has had no releases in the last 12 months, indicating slowed maintenance for a relatively young package.