from

Build provenancecaution

No build attestation or trusted-publisher metadata is available. This weakens publication transparency, but the package is a small unbuilt JavaScript artifact with no runtime dependencies, which limits the practical impact.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer reflects a genuinely narrow apparent backing base. That increases continuity risk alongside the absence of recent activity.

Release historycaution

The package has 7 releases but none in the last 12 months, and the latest release was over nine years ago. This is strong evidence of inactivity, although the small, mature scope may reduce the need for frequent releases.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, while the latest push was over nine years ago. No provided signal shows compensating current maintenance capacity.

Repo issue activitycaution

There is only 1 open issue and no new or closed issues or pull requests in the last month. This indicates little current project activity, though the low issue volume may also reflect the package's narrow scope.