dedent

Build provenancecaution

No build attestation or trusted-publisher provenance is present for the release. This reduces publication transparency, though it is not by itself evidence that the package is unsafe.

Lifecycle scriptscaution

The package declares a prepare install lifecycle script. This is not inherently unsafe, but it adds install-time behavior that should be understood when pinning or mirroring the package.

Project backingcaution

The repository is owned by an individual account rather than an organization. This does not indicate a problem, but it means the project has less visible organizational backing.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the release was recently published, this creates uncertainty about ongoing maintenance capacity.

Repo issue activitycaution

There are six open issues and no recent issue or pull-request activity. The lack of recent issue movement is a mild maintenance concern, but the open issue count is small.