command-line-usage

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent, though this is a supply-chain transparency gap rather than evidence of unsafe behavior.

Maintainerscaution

Only one account has registry publishing access, creating a thin publishing base. The linked repository is also owned by an individual, so there is no organizational backing shown to compensate for that concentration.

Release historycaution

The project is mature, with 52 releases since June 2015, but only one release in the last 12 months. The latest release is recent enough to offset a stronger abandonment concern, while indicating a slower cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release partly offsets this, but current development activity is quiet.

Repo toolingcaution

The repository uses Rollup for builds, but no security scanning tooling is reported. This is a modest hygiene gap, not a standalone adoption blocker.