npm registry · package record
MongoDB object modelling
One account can publish this package. That is a single point of failure with no advisory attached to it.
No application has a dependency path to any release of it.