@ndelangen/get-tarball

Lifecycle scriptscaution

A prepublish lifecycle script is present. This is a mild publication-process concern, but it is not evidence of an install-time execution path by itself.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the ownership relationship is clear, but there is no organizational backing shown.

Release historycaution

The latest registry release was over three years ago, with no releases in the past 12 months. This indicates a largely inactive release process, although the package has eight releases and a stable current major version.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the old latest release, this points to stalled maintenance.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. This creates uncertainty that the linked repository is the actual source for this release.