@rtsao/scc

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency, though this is a secondary concern for the small package artifact.

Maintainerscaution

Only one registry maintainer, rtsao, is listed. That is a thin publishing base and increases continuity risk for a package with otherwise slow activity.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package has clear ownership but no organizational backing.

Release historycaution

The package has only 2 releases, with the latest on April 6, 2022 and none in the last 12 months; this indicates very slow maintenance for a dependency.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. Combined with the old registry release, this is meaningful evidence of slowed maintenance.