crelt

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, so the connection between source and published artifact cannot be independently verified.

Lifecycle scriptscaution

The prepare script can be legitimate build setup, but install-time lifecycle execution adds avoidable supply-chain and installation complexity.

Release historycaution

The package is about six years old, has eight releases, and was updated within the last year. Its sparse recent cadence provides only moderate evidence of active maintenance.