events-listener

Build provenancecaution

No build attestation or trusted-publisher provenance is available, reducing release transparency, though this is a moderate concern rather than evidence of unsafe code.

Maintainerscaution

Only one account has registry publish access, leaving a thin publishing base; the small package scope partly compensates for this limitation.

Release historycaution

The latest release was over eight years ago, with zero releases in the past 12 months; this is the strongest evidence of stagnation, although the package is small and stable.

Repo commit activitycaution

There were zero commits and zero active maintainers in the past three months, consistent with long-term abandonment risk.

Repo toolingcaution

The repository has no build tooling or security scanning tools, leaving fewer automated checks around a release that is otherwise small and dependency-free.