gradient-string

Build provenancecaution

No build attestation or trusted publisher identity is present, reducing publication transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation. This is common for build-oriented packages but adds install-time execution that consumers should account for.

Maintainerscaution

One registry publishing account is listed. The repository is user-owned rather than organization-backed, so the narrow publishing base provides little redundancy.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no demonstrated institutional backing to offset the narrow maintainer base.

Release historycaution

The package has 12 releases over roughly nine years, but no releases in the last 12 months and its latest release was about two years ago. This is a meaningful maintenance concern despite the long history.