webpack-merge

Build provenancecaution

No build attestation or trusted-publisher identity is available, leaving release provenance less transparent even though this is not itself evidence of an unhealthy project.

Lifecycle scriptscaution

A prepare script runs during package lifecycle, which adds some install-time behavior, but this signal alone does not show that the behavior is unsafe or unusually complex.

Maintainerscaution

The registry reports zero publishing-access accounts, which limits transparency about who can publish releases. This is partly offset by the linked repository being owned by an organization, so it is a minor concern rather than evidence of abandonment.

Release historycaution

The package has 91 releases over more than 11 years, but its latest release was over two years ago and it had no releases in the last 12 months, indicating slowed maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has gone quiet. The long release history and existing project structure provide some maturity compensation but do not remove the concern.