@xtuc/long

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence was found. This limits publication transparency, but it is not by itself evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer does not have broader organizational backing shown by the provided evidence.

Release historycaution

The latest registry release was over seven years ago, with no releases in the last 12 months. That is the main maintenance concern, although the package has an established release history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the old registry release, this raises concern about responsiveness to future fixes.

Repo toolingcaution

The repository uses npm scripts and TypeScript for build tooling, but no security scanning tools were detected. The build setup is present; security automation coverage is limited.