cli-spinners

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be.

Project backingcaution

The repository is owned by an individual account rather than an organization, so continuity depends on a relatively narrow ownership base. The package's long history and recent releases provide some compensating evidence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers over the last 3 months, a real maintenance slowdown. This is partly offset by a registry release in the period and a repository push in February 2026.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Token permissionscaution

The only workflow lacks a top-level permissions declaration, so its token permissions are not explicitly minimized.