xregexp

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the published artifact was produced.

Repo bus factorcaution

All recent commits came from one contributor, so maintenance continuity depends heavily on that person.

Repo commit activitycaution

The repository had one commit in the last three months from one active maintainer; this demonstrates current activity but is a thin maintenance cadence.

Repo toolingcaution

The project uses Babel and npm scripts, but no security scanning tool was detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, making the process for reporting and handling vulnerabilities unclear.