for-each

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present. That reduces release transparency, despite the package having a matching source repository.

Lifecycle scriptscaution

A prepack lifecycle script is present. This is limited to packaging rather than installation, but it adds build-time behavior that consumers should account for when verifying publication.

Project backingcaution

The repository is owned by an individual account rather than an organization. That is not inherently unhealthy, but it indicates a thinner formal backing context for a package already showing low recent activity.

Release historycaution

The package is mature at 5102 days old, but only six releases have been published and none arrived in the last 12 months. The latest release was about 19 months ago, indicating limited ongoing release activity.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Together with the sparse release history, this is evidence of limited current maintenance.