typeson

Build provenancecaution

No build attestation or trusted-publisher provenance was found. This reduces publication transparency, but it is not by itself evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the concentrated recent contribution base is not visibly offset by organizational backing.

Repo bus factorcaution

All 18 recent commits came from one contributor, so maintenance capacity is concentrated and could be vulnerable if that contributor becomes unavailable.

Repo toolingcaution

The project uses TypeScript, Rollup, Babel, and npm scripts for its build, showing established build tooling. No security scanning tools were detected, which is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.