@jridgewell/set-array

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the connection between source and published artifact less transparent.

Maintainerscaution

Only one registry account has publish access. That is not inherently unsafe, but combined with zero recent commit activity it indicates limited visible maintenance capacity.

Project backingcaution

The package and repository are consistently owned by the same individual account, so the source linkage is coherent, but there is no organization backing to broaden maintenance capacity.

Release historycaution

The package has had no releases in the last 12 months, and its latest release was over two years ago. Its seven-release history and stable 1.2.1 version provide some maturity, but the long pause lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package's prolonged release pause and increasing abandonment risk.