@ably/msgpack-js

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, although the signal alone does not show that the release is unsafe.

Release historycaution

The package has only 5 releases since September 2018, with no releases in the last 12 months and a median interval of about 406 days. This indicates a slow maintenance cadence, though the latest release was published in July 2025.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months. This is concrete evidence of limited current development activity and raises maintenance risk.

Repo toolingcaution

The repository uses no build tooling and has no detected security-scanning tools. For a small package this may be partly expected, but it leaves fewer automated safeguards and signals of project maturity.

Security policycaution

No security policy was found in the linked repository, reducing transparency about vulnerability reporting and response expectations.