defaults

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving the relationship between source and published artifact less transparent.

Release historycaution

The package has existed since February 2013 with nine releases, but its latest registry release was in October 2023 and there were no releases in the last 12 months. This indicates a slow or paused release cadence, though the repository has newer activity.

Repo bus factorcaution

All recent repository commits came from one contributor. Because the repository owner is an individual rather than an organization, this creates meaningful continuity risk.

Repo commit activitycaution

One commit was recorded in the last three months, so maintenance has not stopped completely, but activity is limited relative to the package's long age and release gap.

Token permissionscaution

The repository's single workflow has no top-level token permissions declaration. Although no write permissions are explicitly reported, the missing restriction is a workflow-hardening gap.