@hapi/podium

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency weakness rather than evidence that the release is unsafe.

Release historycaution

The package has 13 releases since 2019, but none in the last 12 months and the latest was published roughly 20 months ago. Its established history partly offsets the recent pause, but maintenance appears slow.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, consistent with the long release pause and increasing abandonment risk.

Repo toolingcaution

The project uses TypeScript build tooling, but no security scanning tools were detected. That is a hygiene gap, partially offset by the repository's security policy and clean workflow audit.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence audit findings, but its only action use is unpinned. The unpinned reference weakens build reproducibility and update safety.