autolinker

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable. This is a transparency gap rather than evidence of an unsafe release.

Lifecycle scriptscaution

A prepare script runs during installation or publishing. This is not inherently unsafe, but it adds lifecycle execution that consumers should account for.

Maintainerscaution

Two registry accounts have publish access. This is a small publishing group, but the repository is individually owned and the project has a long release history, so it is a moderate rather than severe concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so maintenance capacity depends on a comparatively narrow project backing structure.

Release historycaution

The project has over 12 years of history and 95 releases, but it has made no registry release in the last 12 months. That recent pause lowers confidence in ongoing maintenance.