ts-proto-descriptors

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving publication provenance less transparent than it could be.

Licensecaution

The package declares ISC, but the repository license file is Apache-2.0, so consumers face a meaningful licensing inconsistency even though licensing is documented.

Maintainerscaution

Only one registry account has publishing access, which is a modest publishing continuity concern, though repository activity shows multiple active contributors.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the package-to-repository relationship is less clearly demonstrated.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security scanning tools are reported, leaving a minor security-process gap.