ts-poet

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, so consumers have less evidence connecting the published artifact to its source.

Lifecycle scriptscaution

A prepare install lifecycle script adds some install-time behavior and warrants review, although this signal alone is not evidence that the package is unsafe or unmaintained.

Maintainerscaution

Only one account has registry publish access, creating a limited publishing bus factor; the linked repository owner provides some project continuity but does not remove the single-publisher concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing shown to compensate for the small maintainer base.

Release historycaution

The package has 86 releases over nearly eight years, but no releases in the last 12 months; the long history is reassuring while the recent release gap lowers confidence in current maintenance.