cva

Package file treedanger

The release contains only README.md and package.json, with no implementation files. That makes it unsuitable as a dependency regardless of its recent registry activity.

Package scaffoldingdanger

A README is present, but it says the package is only a placeholder and offers to give away the name; absent tests and a changelog are normal for a published artifact and do not offset that limitation.

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported. This leaves publication provenance unverified, adding a transparency concern.

Release historycaution

The package has existed for about 6 years, with 15 releases and 8 releases in the last 12 months. This shows registry activity, but it does not compensate for the placeholder artifact.

Version stabilitycaution

The assessed version is 0.0.0, and about 87% of recent releases were prereleases, indicating an immature and unstable release line.