d3-dsv

Build provenancecaution

No build attestation or trusted-publisher record is present, leaving publication provenance less transparent. The reproducible-build release note is a partial positive but does not replace an attestation.

Release historycaution

The package has 39 releases since June 2015, but none in the last 12 months and the latest release was in June 2021. This long release gap is a meaningful maintenance concern.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. This suggests limited current maintenance capacity, although the non-archived repository and long project history provide some context.

Repo toolingcaution

The repository uses Rollup for builds, showing an established build process, but no security-scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, though it does not by itself show that the package is unsafe to depend on.