client-only

Release historydanger

This package has had exactly one release, published about four years ago, with no releases in the last 12 months. That strongly suggests abandonment or an unmaintained release line.

Repo package mentiondanger

The repository name does not match the package name and its README does not mention the package. This raises a material concern that the package is piggy-backing on an unrelated popular repository.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent; this is a moderate transparency gap rather than proof of unsafe code.

Maintainerscaution

Only one registry publishing account is listed. The organization-owned repository provides some backing, but the registry-side publishing base remains concentrated.

Package file treecaution

The published artifact contains only three files, including no README, while the linked repository is substantial; this is a thin package surface and makes the package's relationship to that repository important.