fs-monkey

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded. This is a transparency and reproducibility gap, although it is not by itself evidence that the release is unsafe.

Maintainerscaution

Only one account has registry publish access. That can be sufficient for a small package, but it creates a thin publishing base and increases continuity risk if that maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual account rather than an organization. This matches the single-maintainer picture and leaves less visible institutional backing for long-term continuity.

Release historycaution

The project has existed for over 9 years with 20 releases and a roughly 40-day median release interval, but it has made no release in the last 12 months. The long history compensates for some of the recent slowdown, but the current release cadence lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with no release in the last year, this is the clearest sign of possible maintenance slowdown.