cpu-features

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, reducing release transparency. This is a provenance gap, not evidence that the release is unsafe by itself.

Lifecycle scriptscaution

An install script is present, which adds execution during installation and therefore some supply-chain exposure. For a native Node.js binding that must build through node-gyp, this is expected package behavior rather than an inherently severe issue.

Maintainerscaution

Only one registry account has publish access, leaving a thin publishing base. The linked repository is also owned by an individual, so there is no organizational backing shown to compensate for that concentration.

Release historycaution

The package has had no releases in the last 12 months, with the latest release in May 2024 despite a history dating to 2019. This is a meaningful maintenance concern, though the repository remains available and was pushed more recently.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the long gap since the latest registry release, this raises abandonment risk despite the later repository push timestamp.