diacritics

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present. This weakens release transparency, although the package is a small directly published JavaScript artifact.

Maintainerscaution

Only one registry publishing maintainer is listed. That creates a limited continuity and review capacity risk, though the repository is backed by a named individual rather than an unknown publisher.

Project backingcaution

The repository is owned by an individual account rather than an organization. This is consistent with the single-maintainer signal but provides less visible institutional continuity.

Release historycaution

The package has 15 releases since 2012, but its latest release was over nine years ago and there have been no releases in the last 12 months. That is a meaningful maintenance concern for a dependency, even though the utility may be stable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old registry release, this is the strongest evidence that maintenance has largely stopped.