add

Build provenancecaution

No build provenance attestation or trusted publisher is present. This weakens release transparency, but the package has no runtime dependencies and otherwise shows an active, clearly linked repository.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent contribution pattern has less institutional backup. The active second contributor provides limited compensation.

Repo bus factorcaution

One contributor made six of the seven recent commits, or about 86%, leaving maintenance concentrated in one person. A second contributor is active, but the concentration remains a moderate continuity concern.

Repo toolingcaution

The repository reports no build tooling and no security scanning. For this small dependency that is a hygiene gap rather than evidence of abandonment, but it limits automated assurance.

Security policycaution

The repository has no security policy. This reduces transparency for reporting vulnerabilities, though the package's small scope and lack of runtime dependencies partly limit the practical impact.