es6-shim

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing confidence that the registry artifact can be tied to its source build.

Project backingcaution

The repository is owned by an individual account rather than an organization. This is not inherently unhealthy, but it provides less visible institutional backing for long-term maintenance.

Release historycaution

The package has 91 releases and a long history, but it has had no registry release in over three years. This materially raises staleness risk for a compatibility library.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although issue activity and a recent push provide some compensation, current code-change activity is thin.

Repo toolingcaution

The project uses a build tool, but no security-scanning tooling was detected. This is a transparency and hygiene gap rather than evidence of abandonment.