encode-utf8

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving publication provenance less transparent. This is a meaningful supply-chain hygiene gap but not evidence that the release is malicious.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing and maintenance base. This is not by itself severe because the linked project is user-owned and the package is a small utility.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated institutional backing to compensate for the single-maintainer base.

Release historycaution

The package has only five releases and none in the last 12 months; its latest release was about five years ago. This materially lowers confidence in ongoing maintenance, although the long release intervals may fit a small stable utility.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with a project that is no longer actively maintained. The package may be stable, but this raises abandonment risk for future fixes.