croner

Build provenancecaution

No build attestation or trusted-publisher provenance is available, reducing publication transparency, though this is not by itself evidence that the package is unsafe.

Maintainerscaution

Only one registry publishing account is listed, creating some continuity risk, although the linked repository shows an established project and recent release activity.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single registry maintainer represents a genuine continuity risk rather than normal organization publishing hygiene.

Repo commit activitycaution

No commits and no active maintainers were recorded over the last three months, which is a meaningful maintenance concern. Recent releases and pull-request merges partly compensate, but the lack of direct commit activity should be monitored.

Token permissionscaution

Five workflows lack top-level permission declarations and one workflow grants top-level write access, which weakens least-privilege clarity in CI configuration.