tsc-alias

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less independent evidence that the registry artifact came from the reviewed source.

Lifecycle scriptscaution

The package has a prepare install lifecycle script, which adds install-time behavior and a modest supply-chain review concern, though this signal alone is not severe.

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated contributor activity provides less organizational continuity.

Repo bus factorcaution

Two contributors were active in the last three months, but one made 30 of 35 commits, leaving maintenance highly concentrated.

Repo toolingcaution

The project uses TypeScript and npm scripts for builds, but no security-scanning tooling was detected. This is a modest transparency gap, not evidence of abandonment.