coa

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, limiting publication transparency, though this is a supporting concern rather than evidence that the package is unsafe.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the project has no observed organizational backing to compensate for its thin current maintenance activity.

Release historycaution

The package has a long history with 35 releases, but it has had no releases in the last 12 months and its latest registry release is nearly five years old, which lowers confidence in ongoing published maintenance.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, indicating little current development and increasing abandonment risk; the recent repository push provides only limited compensation.

Repo issue activitycaution

The repository has 25 open issues and two open pull requests, with no issues or pull requests closed in the last month, suggesting unresolved maintenance work.