yamux-js

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release was produced. This lowers transparency but is not severe on its own.

Maintainerscaution

Only one registry account has publish access. The repository is also owned by an individual rather than an organization, leaving limited visible maintainer redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. A recent release shows some ongoing activity, but the short-term development pause raises maintenance risk.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tooling was detected. This is a moderate hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That makes vulnerability reporting and response expectations less transparent for a networking library.