xss

Build provenancecaution

No build attestation or trusted publisher identity is present, reducing publication transparency, though this is a provenance gap rather than evidence that the package is unsafe.

Lifecycle scriptscaution

A prepublish lifecycle script adds some build-time supply-chain complexity, although the signal does not show a postinstall script that would run for consumers installing the package.

Maintainerscaution

Only one registry account has publishing access, creating a modest publishing continuity risk; the linked repository and long release history provide some compensating project evidence.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no visible organizational backing to offset the single-publisher structure.

Release historycaution

The package has a long history with 73 releases, but its latest registry release was over two years ago and it had no releases in the last 12 months, indicating slowed publishing.