get-source

Release historydanger

The latest release was about five years ago, with no releases in the last 12 months. The package has a substantial history of 51 releases, but current maintenance appears dormant.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency gap rather than evidence that the release is unsafe.

Licensecaution

The artifact contains a license file and the repository also has one, so the release is licensed. However, the manifest declares Unlicense while the detected file is MIT, creating a transparency mismatch.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, reinforcing the release-history concern.

Repo toolingcaution

The project uses a build tool, but no security-scanning tooling was detected. This is a modest process gap, especially for a package that has otherwise stopped changing.