git-remote-origin-url

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry publishing account is listed, which is a thin publishing base. The linked repository identifies the same individual owner, but recent commit activity is still absent.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the thin maintainer base.

Release historycaution

The package has 0 releases in the last 12 months, and its latest registry release was about 5 years ago. That weakens evidence of ongoing maintenance, although the long release history shows it is established.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. This indicates limited recent development activity, despite the repository not being archived.