@pm2/pm2-version-check

Release historydanger

The latest release was over five years ago, with no releases in the last 12 months. This is strong evidence of abandonment risk despite the package having a multi-year history.

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so the published artifact cannot be independently tied to a verified build process. This is a transparency weakness, but not severe on its own.

Package file treecaution

The artifact contains only README.md, index.js, and package.json, consistent with a small utility but providing limited evidence of project depth or maintenance practices.