@josephg/resolvable

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, so consumers have limited registry-level evidence connecting this release to its source build.

Lifecycle scriptscaution

The package defines a prepare install-time lifecycle script. This is not inherently unsafe, but it adds execution during installation without evidence here of what the script performs.

Release historycaution

The package has only two releases and none in the last 12 months; its latest release was published in May 2021, indicating a long period without updates.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history's prolonged inactivity.

Security policycaution

The repository has no security policy. For a tiny package this is a modest transparency gap, but it provides no documented channel or process for reporting vulnerabilities.