cypress-file-upload

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, reducing release provenance transparency. The repository's publishing workflow provides some compensating process evidence, but not an attestation.

Maintainerscaution

Only one registry publishing account is listed. Because the repository is owned by an individual, this is consistent with the project backing but still leaves limited visible publishing redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to compensate for the thin maintainer base.

Release historycaution

The package has 53 releases, but its latest release was in November 2021 and there have been no releases in nearly five years. The earlier release cadence shows past activity but does not offset the prolonged pause.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the measured three-month period. With no recent registry releases, this is meaningful abandonment risk rather than a cosmetic gap.