comment-json

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication origin less verifiable than it could be; this is a transparency gap rather than a health verdict by itself.

Maintainerscaution

Only one registry publishing account is listed. The repository is user-owned rather than organization-backed, so there is limited visible publishing redundancy.

Project backingcaution

The repository is owned by an individual account, not an organization, providing less visible institutional continuity for a package with one registry maintainer.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This recent pause conflicts with the strong release history and lowers confidence in current maintenance capacity.

Repo issue activitycaution

There is only one open issue and one open pull request, with no issue or pull-request activity in the last month; this is quiet but not strong abandonment evidence alone.