@pdf-lib/upng

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. The package remains traceable to a repository, but consumers have less evidence connecting the published artifact to its source build.

Release historycaution

The package has had only two releases, both in February 2020, with no releases in the last 12 months. This indicates a long-maintained release gap, although the package is stable rather than prerelease.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. The repository is not archived, but recent inactivity increases maintenance risk.

Security policycaution

No security policy was found in the repository. This reduces transparency for reporting and handling vulnerabilities, though it is not evidence of a vulnerability by itself.