emojibase-data

Build provenancecaution

No build attestation, trusted publisher, or staged publishing was detected. This reduces release transparency, though it is a supply-chain hygiene concern rather than a health verdict on its own.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer does not have organizational backing to compensate for the thin maintainer base.

Release historycaution

This is a mature package first released about 9 years ago with 56 releases, but only one release occurred in the last 12 months. The long history helps compensate for the slower recent cadence, though it limits evidence of active ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This is a meaningful maintenance warning, although the recent 17.0.0 release and push about 5 months ago show the project has not clearly been abandoned.

Repo toolingcaution

The project uses TypeScript, Babel, and npm scripts, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.