globrex

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. This limits publication transparency, although the package is a small direct JavaScript artifact.

Maintainerscaution

Only one registry account has publish access. The linked repository is also individually owned, so there is no provided evidence of a broader maintainer or organizational backup.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing shown to compensate for the narrow maintainer base.

Release historycaution

The latest release was published nearly eight years ago, with no releases in the last 12 months. Earlier releases were regular, but the long current gap raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Combined with the stale registry release, this materially increases maintenance risk.