@gar/promisify

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This limits publication transparency, but it is not by itself evidence that the package is unsafe to depend on.

Maintainerscaution

One registry maintainer is a limitation for publishing continuity, but the repository is owned by the corresponding individual rather than an unrelated project, so this is not strong evidence of package misownership.

Project backingcaution

The package is published under @gar and linked to a user-owned repository, providing individual rather than organizational backing. This offers some ownership clarity but limited continuity assurance.

Release historycaution

The latest release was over four years ago, with no releases in the last 12 months. That is meaningful evidence of slowing maintenance, though the package has six releases and is mature rather than experimental.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last year, this supports a maintenance-caution assessment.