get-caller-file

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, so consumers have limited verification of how this release was produced. This is a transparency gap, but it is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script, which adds some installation complexity and supply-chain exposure. No accompanying evidence shows that the script is malicious or unusually dangerous, so this is a moderate concern rather than a severe risk.

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base. The linked repository is owned by the same individual, which provides some consistency but not redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational continuity signal. The consistent owner and matching repository still provide direct project backing.

Release historycaution

The package has 10 releases since 2015, but its latest registry release was over seven years ago and it had no releases in the last 12 months. That substantially lowers confidence in ongoing maintenance, although the package may be stable because its scope is small.