didyoumean

Build provenancecaution

No build attestation or trusted-publisher metadata is available, reducing release transparency, although the package is a small, apparently direct JavaScript distribution.

Maintainerscaution

Only one registry publisher is listed, leaving limited publishing redundancy; this is consistent with the repository being owned by an individual rather than an organization.

Project backingcaution

The repository is owned by an individual account, so there is no organization backing to offset the thin maintainer base or inactivity.

Release historycaution

The package has only four releases and none in the last 12 months; its latest release was over five years ago, indicating substantial abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with development having stopped after the June 2021 release.