@hypnosphi/create-react-context

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, leaving publication provenance less transparent. This is a supply-chain hygiene gap rather than a health verdict by itself.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some install and publication complexity, but the signal does not show a dangerous install-time script.

Maintainerscaution

Only one registry account has publish access, which is a modest bus-factor concern. Because the repository owner is an individual and no organizational backing is shown, this remains a maintenance caution.

Release historycaution

The package has only one release, published in January 2021, with no releases in the last 12 months. That is a meaningful maintenance concern for a dependency, even if the package may be feature-complete.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, following a last push in 2021. This is the strongest evidence of ongoing abandonment risk.