file-url

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot verify how the published artifact was produced. This is a transparency gap, not evidence that the package is unsafe.

Release historycaution

The package has existed for about 12 years, but its latest registry release was about 5 years and 5 months ago, with no releases in the last 12 months. This lowers confidence in ongoing release maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months. That suggests limited current development activity, although the repository is not archived.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous findings, but both of its two action references are unpinned. This is a modest reproducibility and supply-chain hygiene gap.