untun

Build provenancecaution

No build attestation, trusted publisher, or staged publishing was detected, so consumers have limited independently verifiable evidence about how this artifact was produced.

Lifecycle scriptscaution

A prepack lifecycle script is present, so publication involves an automated packaging step. No evidence here shows that it performs risky install-time behavior.

Repo bus factorcaution

One contributor made all 8 commits in the last 3 months, concentrating maintenance risk. Organization ownership provides some ability to hand work off, but no second recently active contributor is shown.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tools were detected, leaving a modest review and monitoring gap.

Security policycaution

The repository has no security policy, so there is no stated process for reporting or handling vulnerabilities.