web-vitals

Build provenancecaution

No build attestation or trusted-publisher identity was recorded, reducing publication transparency. This is offset partly by the active, organization-backed project but remains a provenance gap.

Lifecycle scriptscaution

The package defines a prepare script. This can run during installation or publication, so it is worth noting, although this signal alone does not show harmful behavior.

Maintainerscaution

Two of three publishing accounts use the Google domain, consistent with the organization-backed repository. The outside-domain account philipwalton (philipwalton.com) is an account-hygiene caution, not evidence of a thin maintenance team.

Repo toolingcaution

The repository uses TypeScript, Rollup, npm scripts, and Babel for its build. No security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although active maintenance and organizational backing reduce the abandonment concern.