galactus

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency, though this is a transparency gap rather than evidence of unsafe code.

Lifecycle scriptscaution

The package uses prepare and prepublish scripts, which can run during installation or publication and deserve attention, but these scripts are not by themselves evidence of poor package health.

Maintainerscaution

Only one registry account has publish access, leaving a thin publishing base even though repository activity provides some supporting continuity.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing shown to offset the single registry maintainer.

Release historycaution

The package has six releases since January 2018, but no releases in the last 12 months, indicating a currently slow release cadence.