get-npm-tarball-url

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving publication provenance less transparent than it could be.

Maintainerscaution

Only one registry publishing account is listed, which is a modest resilience concern, though the repository is owned by an organization and the package has an aligned source repository.

Release historycaution

The package has 9 releases over nearly 9.5 years, but no releases in the last 12 months and its latest release was nearly three years ago, indicating reduced maintenance activity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with an effectively inactive project and increasing abandonment risk.

Repo issue activitycaution

There are no open issues and five open pull requests, but no issues or pull requests were merged in the last month, offering little evidence of active support.