common-ancestor-path

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Release historycaution

The package has existed for over 6 years but only 3 releases, with a median interval of about 2 years and 9 months; one release in the last 12 months provides some evidence of continued maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, which is a meaningful maintenance concern despite the recent registry release and repository push evidence.

Repo toolingcaution

The repository reports no build tooling or security scanning tooling; for this small package the build-tool gap is modest, but the lack of security scanning weakens maintenance hygiene.

Workflow auditcaution

Both workflows were analyzed without high-confidence findings or untrusted sinks, but all 7 action references are unpinned and one workflow grants top-level write permissions, creating avoidable update and token-scope risk.