figures

Build provenancecaution

No build attestation or trusted publisher provenance is available, reducing publication transparency, though this is not by itself evidence that the release is unsafe.

Maintainerscaution

Only one account has registry publish access. This is a meaningful continuity risk for a user-owned project, although the repository and package are clearly matched.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-publisher and single-maintainer structure represents a real continuity risk.

Release historycaution

The project has a long history with 25 releases, but it has had no registry release in the last 12 months and the latest release is more than two years old, indicating slowed maintenance.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, reinforcing the concern that maintenance has currently stalled.