get-port

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Maintainerscaution

One registry publishing account is listed, which is a modest concentration concern, though the linked repository and recent release provide compensating evidence of ongoing ownership.

Project backingcaution

The repository is owned by a user account rather than an organization, so the single publishing account represents genuine maintainer concentration rather than organization-backed publishing.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The same-day release push shows current publication activity, but the broader recent development activity remains limited.

Repo toolingcaution

No build tool or security scanning tool was detected. The package is small and has no runtime dependencies, which reduces the significance of this tooling gap, but it still limits visible engineering controls.