get-nonce

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, reducing publication transparency for the distributed artifact.

Lifecycle scriptscaution

A prepublish lifecycle script adds some build-time supply-chain surface, although no other install lifecycle scripts were reported.

Maintainerscaution

Only one registry maintainer is listed, leaving a thin publishing and maintenance base for this package.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer concern is not offset by visible organizational backing.

Release historycaution

Only two releases were published, both in April 2020, with no releases in the last 12 months; this is a meaningful maintenance concern for a dependency.