@colors/colors

Build provenancecaution

No build attestation, trusted publisher identity, staged publishing, or approver is recorded, leaving release origin and reproducibility less transparent.

Maintainerscaution

Only one registry account, dabh, has publish access. This is a modest publishing bus-factor concern, though the repository ownership and recent release provide some compensating project context.

Release historycaution

The package is about 4.6 years old with four releases and a median release interval of about 513 days; one release in the last 12 months and the latest release provide some ongoing evidence, but the cadence is sparse.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months. The recent release and repository push are compensating evidence, but the underlying development cadence remains thin.

Security policycaution

No SECURITY.md or other security policy was found, reducing vulnerability-reporting transparency for adopters.