filelist

Build provenancecaution

The release has no build attestation, trusted publisher, or staged publishing evidence. This limits publication transparency, though it is not a maintenance verdict on its own.

Maintainerscaution

Only one account has registry publish access. That is a thin publishing base and leaves limited redundancy if the maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no visible organizational backing to compensate for the thin maintainer base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This weakens evidence of current development, although recent releases partly offset the concern.

Repo toolingcaution

No build tools or security scanning tools were detected. For a small package this is a hygiene weakness, but it does not by itself indicate abandonment.