@tokenizer/token

Build provenancecaution

No build provenance attestation or trusted-publisher information is present, reducing publication transparency, although this is a secondary concern for a tiny declaration-only package.

Maintainerscaution

Only one registry maintainer is listed, which limits publishing redundancy; the linked repository is user-owned rather than organization-backed.

Release historycaution

The package has had no registry release in over five years, with only four releases overall; this is meaningful maintenance caution despite the repository being pushed more recently.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month period, leaving current development activity thin despite the more recent repository push.

Repo toolingcaution

The repository reports no build tool or security scanning tool; this is a modest transparency and maintenance gap for a very small declaration-only project.