binary-extensions

Build provenancecaution

No build attestation or trusted-publisher provenance was observed, leaving publication-to-source traceability weaker than ideal for a released dependency.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no organizational backing signal; the matching repository and recent release provide some compensating evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, a maintenance slowdown that is partly offset by the very recent package release but still warrants caution.

Repo toolingcaution

No build tools or security-scanning tools were detected, reducing observable engineering and security-process transparency.

Token permissionscaution

The only workflow lacks top-level token permissions. No write-enabled top-level permissions were observed, but the omission leaves least-privilege configuration less explicit.