@jimp/plugin-circle

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This is a transparency gap, though it does not by itself indicate that the package is unsafe to depend on.

Release historycaution

The package has existed for about 8 years with 234 releases and one release in the last 12 months. The long history is reassuring, although the recent cadence is thin.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite the recent release. This is the clearest abandonment-risk signal in the assessment.

Repo issue activitycaution

Only one issue was opened and no issues were closed in the last month; two pull requests were opened and none were merged. This suggests limited recent project activity.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts for builds, but no security scanning tools were detected. The missing scanning is a modest hygiene gap.