fast-levenshtein

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing transparency about how the published artifact was produced. This is a real hygiene gap but not by itself evidence that the package is unsafe to depend on.

Maintainerscaution

Only one registry account has publish access. That is a limited publishing safety net for an individually owned project, though this administrative signal does not by itself show that maintenance has stopped.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to compensate for the single-maintainer and inactive-project concerns.

Release historycaution

The package has a long history and 20 releases, but it has had no release in over six years and none in the last 12 months. That materially raises abandonment and compatibility risk despite its established history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Combined with the old release history, this is the strongest maintenance concern for adopting the package.