uri-js-replace

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release was produced.

Licensecaution

The manifest declares MIT, while the repository license file was detected as MIT-0. The package is licensed, but the declaration and detected repository license do not match.

Maintainerscaution

Only one registry account has publish access. That is a limited publishing base for a user-owned project and increases continuity risk if the maintainer becomes inactive.

Project backingcaution

The repository is owned by an individual GitHub user rather than an organization, so there is no visible organizational backing to compensate for the single-maintainer base.

Release historycaution

There have been no releases in the last 12 months, and the latest release was in August 2024 despite the package being about two years old. This is a meaningful maintenance concern, though the 16-release history shows initial activity.