worker-timers-broker

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin and artifact reproducibility less transparent despite the otherwise active project.

Lifecycle scriptscaution

The package has a prepare install-time script, adding execution during installation and therefore some supply-chain exposure, although this signal alone does not indicate an unsafe package.

Project backingcaution

The repository is owned by an individual rather than an organization, so the one-person maintenance concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 56 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited handoff resilience.

Repo toolingcaution

The project uses Vite, Rollup, TypeScript, npm scripts, and Babel, showing an established build process, but no security-scanning tools were detected.