code-excerpt

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers during the last three months. Combined with the old latest release, this indicates a dormant project and raises abandonment risk.

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, though it is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

The package has a prepare install-time lifecycle script. This is not inherently unsafe, but it adds installation behavior that consumers should account for.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the thin maintainer base or dormant activity.

Release historycaution

The package has 9 releases over about 10 years, but its latest release was in February 2022 and there were no releases in the last 12 months. This is a meaningful maintenance concern for a dependency.