culori

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less evidence connecting the published artifact to its source build. The package still has a mature source tree and release history to provide partial context.

Release historycaution

The package has 257 releases and a long history, but no registry releases in the last 12 months; the latest release was about 15 months ago. This indicates a meaningful slowdown despite the mature release record.

Repo bus factorcaution

All recent commits came from one contributor, with one active contributor in the last 3 months. Organization backing offers some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, showing limited recent development activity. This supports the release-history concern, although the recent push indicates the repository is not entirely dormant.

Repo toolingcaution

The project uses esbuild and npm scripts, showing an established build process, but no security scanning tools were detected. The build tooling is a positive, while the missing scanning is a modest transparency gap.