acorn-import-attributes

Name lookalikedanger

The name uses Acorn's identity and the README explicitly presents the package as support for Acorn, while artifact overlap is unknown and the repository is a matching plugin repository. This still creates meaningful identity and provenance ambiguity for consumers expecting the established acorn package.

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, reducing publication transparency for the artifact.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the project has limited visible institutional backing.

Release historycaution

There have been six releases since May 2023, but none in the last 12 months and the latest was March 2024, indicating materially slowed maintenance.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. The last push was in October 2024, so recent maintenance capacity is limited.