exegesis-express

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old latest release, this is the strongest evidence that maintenance has effectively stalled.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing transparency about how the artifact was produced. This is a supply-chain transparency gap, but not evidence that the release is unsafe by itself.

Lifecycle scriptscaution

The package uses a prepare install lifecycle script. This adds installation complexity and deserves review, but the available signals do not show that it performs a dangerous action.

Maintainerscaution

Only one registry publishing account is listed, which is a modest publishing resilience concern, though the matching organization-backed repository provides some compensating project structure.

Release historycaution

The package has 14 releases since 2018, but none in the last 12 months and its latest release was nearly five years ago. This long release gap is a meaningful maintenance concern despite the established history.