@xhmikosr/decompress-targz

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable; this is a transparency limitation rather than evidence of an unsafe release.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer activity provides limited evidence of handoff capacity.

Repo bus factorcaution

All recent commits come from one contributor, so maintenance depends on a single person; the active repository and recent release partly compensate but do not remove this concentration risk.

Repo commit activitycaution

There was 1 commit in the last 3 months from 1 active maintainer, showing some recent activity but only a thin maintenance cadence.

Security policycaution

No repository security policy is present. For a small focused package this is a modest transparency gap, not a severe dependency-health concern.