encoding

Build provenancecaution

No build provenance attestation or trusted-publisher configuration is present, so consumers have limited evidence connecting the published artifact to its source. This is a supply-chain transparency gap, not a malware verdict.

Licensecaution

The package declares MIT and includes a license file, but the artifact file was detected as MIT-0. The release is licensed, though the declaration and detected license do not match exactly.

Maintainerscaution

Only one registry publishing maintainer is listed, and the repository owner is an individual rather than an organization. This leaves a thin visible support base.

Release historycaution

The package has 13 releases since August 2012, but its latest release was in July 2020 and it had no releases in the last 12 months, indicating prolonged release inactivity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the measured three months. The repository is not archived, but current development activity is absent.