get-proto

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence was collected. This reduces release transparency, although it is a provenance gap rather than a direct health verdict.

Lifecycle scriptscaution

The package declares prepack and prepublish lifecycle scripts, which add build-time execution during publication and packaging. These are not evidence of malicious behavior, but they warrant more care than a package with no lifecycle automation.

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base and some continuity risk. This is not by itself severe because the linked repository and package identity are consistent.

Release historycaution

The package is about 1 year 8 months old but has only two releases, both on January 2, 2025, with no releases in the last 12 months. This is a meaningful maintenance concern for a dependency, though the small utility scope may reduce the need for frequent releases.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, indicating currently stalled development. The repository was pushed in January 2026, which provides some recent evidence of maintenance but does not offset the recent inactivity entirely.