emittery

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so the registry artifact's relationship to its source is less independently verifiable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent activity represents a genuine single-maintainer dependency.

Repo bus factorcaution

One contributor made 100% of the 3-month commit activity, leaving maintenance dependent on a single active contributor.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded in the last 3 months. The current release and long release history partly compensate, but recent activity is thin.

Repo toolingcaution

No build tool or security-scanning tool was detected in the repository. This is a transparency and maintenance-hygiene gap, though the small zero-dependency package is simple to build.