anynum

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving release origin less transparent; this is a transparency gap rather than evidence of unsafe code.

Maintainerscaution

One registry publisher creates concentration risk, but the linked repository is owned by an organization, which provides some capacity to hand off publishing and maintenance.

Release historycaution

The package is only 109 days old with two releases and a median interval of about 9 days, so its maintenance record is still limited rather than established.

Repo bus factorcaution

All recent commits come from one contributor, creating a low bus factor; organization ownership partly compensates by providing a broader maintenance home.

Repo commit activitycaution

Only one commit from one active maintainer appears in the last three months, which is limited activity for a young package but does not show complete abandonment.