archiver-utils

Build provenancecaution

The release has no build provenance attestation or staged publishing evidence, so consumers cannot verify how the published artifact was produced. This lowers supply-chain transparency without making the package unfit by itself.

Release historycaution

The package has 16 releases since November 2015, but none in roughly 2 years and 6 months; this is a meaningful maintenance warning for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. Its recent push timestamp provides some evidence of repository activity, but not of ongoing development.

Security policycaution

The linked repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This is a transparency gap, though it is less serious than the maintenance slowdown.

Type declarationscaution

No type declarations are included, which adds integration friction for TypeScript consumers. This is a consumer-ergonomics gap rather than evidence of abandonment.