create-hmac

Build provenancecaution

No build provenance attestation or trusted-publisher metadata is present, limiting release transparency. This is a supply-chain hygiene gap, not a health verdict by itself.

Dependency profilecaution

Six runtime dependencies are declared for this browser-oriented cryptographic utility. This is a moderate dependency surface and adds some maintenance exposure without being unusually large.

Release historycaution

The latest registry release was published about 8 years ago, with no releases in the last 12 months. This is a meaningful freshness and maintenance concern, although the linked repository was pushed more recently.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months. Combined with the old registry release, this indicates limited current development activity, though the repository's 2024 push is compensating evidence.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, while seven issues and four pull requests remain open. This suggests limited recent project activity.