@grammyjs/runner

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Lifecycle scriptscaution

The package runs a prepare install-time lifecycle script. This is not inherently unsafe, but it adds build and installation complexity compared with a package without lifecycle scripts.

Release historycaution

The package has 17 releases since March 2021, but none in the last 12 months and its latest registry release was in March 2023. This prolonged release gap is a meaningful maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The last push in 2024 provides some counterevidence, but current maintenance activity is still weak.

Repo issue activitycaution

There are four open issues and no recent issue or pull request activity. The lack of recent resolution reinforces the maintenance concern, though the small issue count is not severe on its own.