clipboard

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, reducing publication transparency even though the repository provides build tooling and publishing workflows.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some install or publishing complexity, although this signal alone does not indicate severe risk.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is less visible institutional backing for long-term maintenance.

Release historycaution

The project has a long history and 47 releases, but its latest registry release was over four years ago and there were no releases in the last 12 months. That is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Combined with the old registry release, this suggests maintenance has slowed substantially.