email-validator

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so registry consumers cannot verify how it was published. This is a modest transparency limitation for an otherwise small package.

Licensecaution

A license file is present, but the registry declares MIT while the artifact identifies Unlicense. The mismatch creates a real licensing-clarity concern even though the package is not unlicensed.

Release historycaution

The package has had no registry release in more than 8 years, despite 20 historical releases; this is a substantial maintenance and abandonment concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, providing no evidence of current development capacity.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, not evidence of an unsafe package.