cmdk

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing transparency about how the registry artifact was produced. The reproducible-looking package contents and linked source repository provide some context but do not replace provenance.

Release historycaution

The project has 39 releases over roughly six years, but there have been no releases in the last 12 months and the latest release was about 18 months before collection. That indicates slowed maintenance, although the established history is a compensating signal.

Repo commit activitycaution

There were zero commits and zero active maintainers in the three months before collection, a direct sign that active development has paused. The recent repository push and mature release history partly offset, but do not remove, this maintenance concern.

Repo issue activitycaution

The repository still has open issues and pull requests, with one new issue and one new pull request in the last month, but neither was closed or merged during that period. This suggests ongoing demand without evidence of recent resolution capacity.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and tsup for builds, showing a defined build process, but it reports no security-scanning tools.