xml-formatter

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, limiting verification of how the registry artifact was produced.

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned, so no organizational handoff evidence compensates for this concentration.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity despite the recent repository push and release history.

Repo toolingcaution

TypeScript and Babel provide an established build process, but no security scanning tools were detected, leaving a modest security-hygiene gap.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and maintenance expectations.