cookiejar

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the registry artifact was produced.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing shown to offset the thin maintenance evidence.

Release historycaution

The package has 20 releases since March 2011, but no release in the last three years and eight months; this indicates substantially slowed maintenance despite its long history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with a project that has been dormant for years.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with five open issues and one open pull request; unresolved maintenance demand is visible.