cache-base

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a supply-chain transparency gap, but not by itself evidence that the release is unsafe.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the thin maintenance evidence. This increases reliance on the observed activity, which is currently low.

Release historycaution

The package has 24 releases over about 12 years, but none in the last 12 months and its latest release was in November 2021. This long release gap materially raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old latest release, this is strong evidence that active maintenance has stalled.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with two open issues and three open pull requests. This supports the broader picture of low current project activity.