eslint-config-standard

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This lowers publication transparency somewhat, but it is a supply-chain transparency gap rather than evidence that the package is unsafe or unfit on its own.

Release historycaution

The package has a long history and 83 releases, but its latest registry release was about three years and four months before collection, with no releases in the last 12 months. That materially raises freshness and maintenance concerns despite the historically regular release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the recent push timestamp is reassuring, the observed short-term activity is still a maintenance concern.

Repo issue activitycaution

There are 12 open issues and 17 open pull requests, showing an active backlog, but no issues or pull requests were created or closed in the last month. This is consistent with the broader caution about current maintenance pace.

Token permissionscaution

Neither workflow declares top-level token permissions. While this is less explicit than a read-only declaration, no workflow has top-level write permissions, so the concern is limited.