assert-never

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, reducing publication transparency. This is a provenance gap, but it does not by itself indicate that the package is unsafe to depend on.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding a small amount of publish-time build complexity. No compensating build-provenance signal is present, so this is a minor hygiene concern rather than a severe risk.

Release historycaution

The package has existed since 2017, but its six releases are widely spaced and there have been no releases in the last 12 months; the latest was about 21 months ago. This suggests slowing maintenance, though a small stable utility may need few releases.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, consistent with roughly 21 months since the last push. That materially raises the chance that future fixes will be slow.

Security policycaution

The repository has no security policy, leaving no documented reporting path. For a small utility this is a transparency gap, but it is not evidence of abandonment on its own.