balanced-match

Build provenancecaution

No build attestation or trusted publisher information is available, leaving publication provenance less verifiable; the repository’s security tooling and clear source tree provide partial transparency but do not replace attestation.

Lifecycle scriptscaution

A prepare install-time script is present, which adds some installation complexity; no evidence in this signal shows that it performs unsafe actions, so this is only a modest concern.

Maintainerscaution

Only one registry account has publish access, creating a modest continuity risk; this is not an abandonment finding because the repository and release history show recent activity.

Project backingcaution

The repository is owned by a named individual rather than an organization, so the project has a narrower apparent backing model; this is partly offset by recent releases and repository activity.

Repo issue activitycaution

There are only 5 open issues and 4 open pull requests, but no issues or pull requests were opened, closed, or merged in the last month; this is a mild activity concern offset by the recent repository push and release history.