@iarna/toml

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less verifiable. This is a transparency gap, not a health verdict by itself.

Lifecycle scriptscaution

The package uses prepack and prepare lifecycle scripts, adding build-time execution surface. These scripts may be normal for packaging, but they warrant review because their behavior runs during package workflows.

Project backingcaution

The package and repository are owned by the same individual account, so the source backing is coherent. A single-person project can still be healthy, but it provides less organizational continuity.

Release historycaution

The package has 29 releases and a long history, but its latest release was six years ago with no releases in the last 12 months. That materially raises abandonment and stale-bug risk despite the package's maturity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old registry release, this suggests limited current maintenance capacity.