uuidv7

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving the relationship between source and published artifact less transparent.

Lifecycle scriptscaution

A prepare install-time script is present. This is a modest supply-chain and installation-complexity concern because its behavior is not shown by this signal.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer offers limited institutional handoff capacity.

Repo toolingcaution

TypeScript and npm build tooling are used, supporting a structured build, although no security-scanning tool is reported.

Security policycaution

The repository has no security policy, which weakens disclosure guidance but is a limited transparency gap rather than evidence of abandonment.