worker-timers-worker

Build provenancecaution

No build attestation or trusted-publisher provenance is provided, reducing release transparency; the long release history and matching repository provide some compensating evidence.

Lifecycle scriptscaution

A prepare install-time script is present. This is not inherently unsafe, but it adds installation behavior that consumers should understand before relying on the package.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration has less organizational redundancy to offset it.

Repo bus factorcaution

All 53 recent commits came from one contributor, creating a meaningful continuity risk despite the strong activity level.

Repo toolingcaution

The project uses Rollup, TypeScript, npm scripts, and Babel for builds, but no security-scanning tools were detected, leaving a modest assurance gap.