duration

Release historydanger

The package has existed for over 14 years with eight releases, but has had no release in more than seven years. The long gap materially raises staleness risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old registry release, this is the strongest abandonment concern.

Build provenancecaution

No build provenance attestation or trusted-publisher setup is present. This limits publication transparency, but is a supply-chain transparency gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account can publish the package. That is a limited publishing base and increases continuity risk, though it is not evidence of inactivity on its own.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer is consistent with the project’s backing but still leaves a thin continuity base.