Repository metadata fields present

The npm package page is often the first place a consumer lands after npm install. Without a repository field, the page has no link to the source code — consumers cannot report bugs, read the source to understand behavior, or check if the project is actively maintained. ISO 25010 analysability requires that the package's provenance be traceable. A missing bugs URL means issues go unreported or are sent to the wrong place. These fields take 60 seconds to add and have zero downside.

Add repository, homepage, and bugs fields to package.json. All three are displayed on the npm package page.

{
  "repository": {
    "type": "git",
    "url": "https://github.com/yourorg/your-package.git"
  },
  "homepage": "https://github.com/yourorg/your-package#readme",
  "bugs": {
    "url": "https://github.com/yourorg/your-package/issues"
  }
}

All three fields must be present for a full pass. The repository field alone satisfies the minimum requirement — homepage and bugs are additional signals. For private packages ("private": true), this check is skipped.