cockatiel

Build provenancecaution

No build attestation or trusted-publisher provenance was detected. This weakens publication transparency, although it does not by itself indicate that the package is unsafe to use.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has a narrower visible institutional backing and may depend more heavily on one owner.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months. The recent repository push and four merged pull requests in the last month provide some counterevidence, but the lack of direct commit activity still warrants caution about ongoing maintenance.

Repo toolingcaution

TypeScript build tooling is present, but no security-scanning tools were detected. The build setup is a positive, while the missing scanning is a modest transparency gap.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting and response expectations undocumented.