url-parse-lax

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, so release provenance is less transparent than it could be. This is a supply-chain transparency gap, not evidence that the release is malicious.

Maintainerscaution

Only one registry account has publish access, which creates publishing concentration, although the linked repository shows that the same maintainer is actively maintaining the project.

Project backingcaution

The repository is owned by a named individual rather than an organization, so it does not provide organizational maintenance backing. Recent repository activity and the matching package repository provide some compensation.

Release historycaution

The package has existed for about 11 years with six releases, but it had no registry release in the 12 months before collection. The recent repository push and release notes partly compensate for the slow cadence, but the release pattern still suggests limited maintenance throughput.

Repo bus factorcaution

All recent repository commits came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset that concentration.