defer-to-connect

Lifecycle scriptscaution

A prepare install-time script adds execution during installation, increasing build and supply-chain surface even though no malicious behavior is established by this health assessment.

Maintainerscaution

Only one registry account has publish access; this is a thin publishing base and gives the project limited visible redundancy, though it does not by itself prove abandonment.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to offset the thin maintainer base.

Release historycaution

The package has had no release in over five years, despite nine releases overall; its earlier release cadence was reasonably established, but current maintenance is stale.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the measured three-month period, materially weakening evidence of current maintenance.